Guardrails / build

The build runs on a managed CI runner

build/runs-on-hosted-ci@v1

The artifact was built by a CI platform rather than on somebody's workstation, so the build is attributable and repeatable.

Id	build/runs-on-hosted-ci
Version	v1
Category	build
Default severity	error
Interpreter	python3
Timeout	30 seconds
Violations tolerated	0
Collects	env

Collectors

This guardrail gathers nothing itself. It depends on the collectors below, which the CLI runs once per build before any check, and reads what they found out of GUARDRAIL_FACTS. A collector that collects nothing skips this guardrail rather than failing it.

Collector	Gathers	Inputs it is given
env	Where the build is running: which CI provider, whether the runner is hosted or self hosted, what triggered it, and whether federated credentials are available to it.	none

The inputs above are this guardrail's own, passed straight through. Configuring one in buildnote.json changes what is collected, and two guardrails configured the same way share the one collection.

Configuration

{
  "guardrails": {
      "failOn": "error",
      "comment": true,
      "checks": [
          {
              "use": "build/runs-on-hosted-ci@v1",
              "severity": "error",
              "with": {
                  "allowSelfHosted": "true"
              },
              "exemptions": []
          }
      ]
  }
}

Inputs

Input	Description	Default	Environment variable
allowSelfHosted	Whether a self hosted runner counts. Set to false where only the provider's own hosted fleet is trusted to build a release.	true	GUARDRAIL_INPUT_ALLOWSELFHOSTED

How to fix

Build releasable artifacts in the pipeline, not on a laptop. A workstation build has no attributable identity, no clean environment and no record, which is what SLSA Build L2 asks a build platform to provide.

When a guardrail run on a workstation is legitimate, exempt it locally rather than removing the guardrail:

buildnote guardrails --only git/conventional-commits

More in build

• build/dependency-updates-configured. The repository configures a tool that opens the dependency update, so upgrades arrive as reviewable pull requests rather than as a task nobody has time for.
• build/gradle-version-floor. The Gradle version the wrapper pins is at or above the floor the team sets, so the build runs on a toolchain that is still supported.
• build/wrapper-distribution-verified. The Gradle wrapper pins the checksum of the distribution it downloads, so the toolchain cannot be swapped underneath the build.

All 4 build guardrails