filip/Stalwart
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Cosign artifacts (closes #1039)

Browse Source
This commit is contained in:
Mauro D.
2025-03-24 16:28:19 +01:00
committed by GitHub
parent 4138ef6fc9
commit b23ea6e599
1 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
.github/workflows/ci.yml vendored
View File

@@ -41,6 +41,8 @@ jobs:
needs: [linux] needs: [linux]
if: github.event_name == 'push' || inputs.Docker if: github.event_name == 'push' || inputs.Docker
steps: steps:
- name: Install Cosign
uses: sigstore/cosign-installer@v3
- name: Log In to GitHub Container Registry - name: Log In to GitHub Container Registry
uses: docker/login-action@v3 uses: docker/login-action@v3
with: with:
@@ -82,6 +84,8 @@ jobs:
echo "GHCR_DIGEST_SHA=$(cat GHCR_DIGEST_SHA)" | tee -a "${GITHUB_ENV}" echo "GHCR_DIGEST_SHA=$(cat GHCR_DIGEST_SHA)" | tee -a "${GITHUB_ENV}"
docker buildx imagetools inspect --format '{{json .Manifest}}' index.docker.io/${{github.repository}}:$(jq -r '.target."docker-metadata-action".args.DOCKER_META_VERSION' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json) | jq -r '.digest' > DOCKERHUB_DIGEST_SHA docker buildx imagetools inspect --format '{{json .Manifest}}' index.docker.io/${{github.repository}}:$(jq -r '.target."docker-metadata-action".args.DOCKER_META_VERSION' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json) | jq -r '.digest' > DOCKERHUB_DIGEST_SHA
echo "DOCKERHUB_DIGEST_SHA=$(cat DOCKERHUB_DIGEST_SHA)" | tee -a "${GITHUB_ENV}" echo "DOCKERHUB_DIGEST_SHA=$(cat DOCKERHUB_DIGEST_SHA)" | tee -a "${GITHUB_ENV}"
cosign sign --yes $(jq --arg GHCR_DIGEST_SHA "$(cat GHCR_DIGEST_SHA)" -cr '.target."docker-metadata-action".tags | map(select(startswith("ghcr.io/${{github.repository}}")) | . + "@" + $GHCR_DIGEST_SHA) | join(" ")' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json)
cosign sign --yes $(jq --arg DOCKERHUB_DIGEST_SHA "$(cat DOCKERHUB_DIGEST_SHA)" -cr '.target."docker-metadata-action".tags | map(select(startswith("index.docker.io/${{github.repository}}")) | . + "@" + $DOCKERHUB_DIGEST_SHA) | join(" ")' ${{ runner.temp }}/${{matrix.variant}}/bake-meta.json)
- name: Attest GHCR - name: Attest GHCR
uses: actions/attest-build-provenance@v2 uses: actions/attest-build-provenance@v2
@@ -411,16 +415,25 @@ jobs:
archive/**/*.tar.gz archive/**/*.tar.gz
archive/**/*.zip archive/**/*.zip
- name: Use cosign to sign existing artifacts
uses: sigstore/gh-action-sigstore-python@v3.0.0
with:
inputs: |
archive/**/*.tar.gz
archive/**/*.zip
- name: Release - name: Release
uses: softprops/action-gh-release@v2 uses: softprops/action-gh-release@v2
with: with:
files: | files: |
archive/**/*.tar.gz archive/**/*.tar.gz
archive/**/*.zip archive/**/*.zip
archive/**/*.sigstore.json
prerelease: ${{!startsWith(github.ref, 'refs/tags/') || null}} prerelease: ${{!startsWith(github.ref, 'refs/tags/') || null}}
tag_name: ${{!startsWith(github.ref, 'refs/tags/') && 'nightly' || null}} tag_name: ${{!startsWith(github.ref, 'refs/tags/') && 'nightly' || null}}
# TODO add instructions about using cosign to verify binary artifact
append_body: true append_body: true
body: | body: |
<hr /> <hr />
## Check binary attestation at [here](${{ steps.attest.outputs.attestation-url }}) ### Check binary attestation at [here](${{ steps.attest.outputs.attestation-url }})