sign images using cosign

Signed-off-by: Gaël Goinvic <gaelg@element.io>
pull/26817/head
Gaël Goinvic 2024-01-03 10:42:32 +01:00 committed by Ben Banfield-Zanin
parent 02fd35dad0
commit 7359c9bf93
1 changed files with 18 additions and 0 deletions

View File

@ -7,6 +7,9 @@ on:
# This job can take a while, and we have usage limits, so just publish develop only twice a day # This job can take a while, and we have usage limits, so just publish develop only twice a day
- cron: "0 7/12 * * *" - cron: "0 7/12 * * *"
concurrency: ${{ github.workflow }}-${{ github.ref_name }} concurrency: ${{ github.workflow }}-${{ github.ref_name }}
permissions:
id-token: write # needed for signing the images with GitHub OIDC Token
jobs: jobs:
buildx: buildx:
name: Docker Buildx name: Docker Buildx
@ -26,6 +29,9 @@ jobs:
with: with:
fetch-depth: 0 # needed for docker-package to be able to calculate the version fetch-depth: 0 # needed for docker-package to be able to calculate the version
- name: Install Cosign
uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3
- name: Prepare - name: Prepare
if: matrix.prepare if: matrix.prepare
run: ${{ matrix.prepare }} run: ${{ matrix.prepare }}
@ -58,6 +64,7 @@ jobs:
${{ matrix.flavor }} ${{ matrix.flavor }}
- name: Build and push - name: Build and push
id: build-and-push
uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5 uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5
with: with:
context: . context: .
@ -66,6 +73,17 @@ jobs:
tags: ${{ steps.meta.outputs.tags }} tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }} labels: ${{ steps.meta.outputs.labels }}
- name: Sign the images with GitHub OIDC Token
env:
DIGEST: ${{ steps.build-and-push.outputs.digest }}
TAGS: ${{ steps.meta.outputs.tags }}
run: |
images=""
for tag in ${TAGS}; do
images+="${tag}@${DIGEST} "
done
cosign sign --yes ${images}
- name: Update repo description - name: Update repo description
if: matrix.variant == 'vanilla' if: matrix.variant == 'vanilla'
uses: peter-evans/dockerhub-description@e98e4d1628a5f3be2be7c231e50981aee98723ae # v4 uses: peter-evans/dockerhub-description@e98e4d1628a5f3be2be7c231e50981aee98723ae # v4