Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

馃尡 Signing scorecard images using cosign #1970

Merged
merged 2 commits into from May 31, 2022
Merged

馃尡 Signing scorecard images using cosign #1970

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a4e6166
--wip-- [skip ci]
naveensrinivasan May 28, 2022
b1224a4
:seedling: Signing scorecard images using cosign
naveensrinivasan May 28, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
17 changes: 12 additions & 5 deletions .github/workflows/publishimage.yml
View file
Open in desktop
Expand Up @@ -22,30 +22,32 @@ permissions:
on:
push:
branches:
- main
- main
env:
GO_VERSION: 1.17.7

jobs:
unit-test:
name: publishimage
runs-on: ubuntu-latest
env:
COSIGN_EXPERIMENTAL: "true"
steps:
- name: Harden Runner
uses: step-security/harden-runner@248ae51c2e8cc9622ecf50685c8bf7150c6e8813 # v1
uses: step-security/harden-runner@248ae51c2e8cc9622ecf50685c8bf7150c6e8813
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

- name: Clone the code
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v2.3.4
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
with:
fetch-depth: 0
- name: Setup Go
uses: actions/setup-go@b22fbbc2921299758641fab08929b4ac52b32923 # v2.2.0
uses: actions/setup-go@b22fbbc2921299758641fab08929b4ac52b32923
with:
go-version: ${{ env.GO_VERSION }}
- name: install ko
uses: imjasonh/setup-ko@2c3450ca27f6e6f2b02e72a40f2163c281a1f675 # v0.4
uses: imjasonh/setup-ko@2c3450ca27f6e6f2b02e72a40f2163c281a1f675
- name: publishimage
uses: nick-invision/retry@7f8f3d9f0f62fe5925341be21c2e8314fd4f7c7c
with:
Expand All @@ -56,3 +58,8 @@ jobs:
go env -w GOFLAGS=-mod=mod
make install
make scorecard-ko
- name: Install Cosign
uses: sigstore/cosign-installer@f700e6fbbab82f6897758a3af7a8dede4e308656
- name: Sign image
run: |
cosign sign ghcr.io/${{github.repository_owner}}/scorecard/v4:${{ github.sha }}