cloudbuild.yaml

#
# Copyright 2021 The Sigstore Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

timeout: 3600s

steps:
- name: gcr.io/cloud-builders/git
  dir: "go/src/sigstore"
  args:
  - "clone"
  - "https://github.com/${_TOOL_ORG}/${_TOOL_REPO}"

- name: gcr.io/cloud-builders/git
  entrypoint: "bash"
  dir: "go/src/sigstore/cosign"
  args:
  - '-c'
  - |
    git fetch
    echo "Checking out ${_GIT_TAG}"
    git checkout ${_GIT_TAG}

- name: 'gcr.io/projectsigstore/cosign:v1.5.1@sha256:6247b2e693b0e6a62dcfa75eb46b698c1f4cd1aca36aaefafd4bbb2f2b2af717'
  dir: "go/src/sigstore/cosign"
  env:
  - COSIGN_EXPERIMENTAL=true
  - TUF_ROOT=/tmp
  args:
  - 'verify'
  - 'ghcr.io/gythialy/golang-cross:v1.17.7-0@sha256:949325ffc52c16867d78412ce70f5ce531812c20e7528ae70dc9e718d72223e8'

# maybe we can build our own image and use that to be more in a safe side
- name: ghcr.io/gythialy/golang-cross:v1.17.7-0@sha256:949325ffc52c16867d78412ce70f5ce531812c20e7528ae70dc9e718d72223e8
  entrypoint: /bin/sh
  dir: "go/src/sigstore/cosign"
  env:
  - "GOPATH=/workspace/go"
  - "GOBIN=/workspace/bin"
  - PROJECT_ID=${PROJECT_ID}
  - KEY_LOCATION=${_KEY_LOCATION}
  - KEY_RING=${_KEY_RING}
  - KEY_NAME=${_KEY_NAME}
  - KEY_VERSION=${_KEY_VERSION}
  - GIT_TAG=${_GIT_TAG}
  - GOOGLE_SERVICE_ACCOUNT_NAME=keyless@${PROJECT_ID}.iam.gserviceaccount.com
  - COSIGN_EXPERIMENTAL=true
  secretEnv:
  - GITHUB_TOKEN
  args:
    - '-c'
    - |
      make release

- name: ghcr.io/gythialy/golang-cross:v1.17.7-0@sha256:949325ffc52c16867d78412ce70f5ce531812c20e7528ae70dc9e718d72223e8
  entrypoint: 'bash'
  dir: "go/src/sigstore/cosign"
  env:
  - "GOPATH=/workspace/go"
  - "GOBIN=/workspace/bin"
  - PROJECT_ID=${PROJECT_ID}
  - KEY_LOCATION=${_KEY_LOCATION}
  - KEY_RING=${_KEY_RING}
  - KEY_NAME=${_KEY_NAME}
  - KEY_VERSION=${_KEY_VERSION}
  - GIT_TAG=${_GIT_TAG}
  - KO_PREFIX=gcr.io/${PROJECT_ID}
  - COSIGN_EXPERIMENTAL=true
  - GOOGLE_SERVICE_ACCOUNT_NAME=keyless@${PROJECT_ID}.iam.gserviceaccount.com
  secretEnv:
  - GITHUB_TOKEN
  args:
  - '-c'
  - |
    gcloud auth configure-docker \
    && make sign-container-release \
    && make sign-keyless-release

availableSecrets:
  secretManager:
  - versionName: projects/${PROJECT_NUMBER}/secrets/GITHUB_TOKEN/versions/latest
    env: GITHUB_TOKEN

artifacts:
  objects:
    location: 'gs://${_STORAGE_LOCATION}/${_GIT_TAG}'
    paths:
    - "go/src/sigstore/cosign/dist/*"
    - "go/src/sigstore/cosign/release/release-cosign.pub"

options:
  machineType: E2_HIGHCPU_8

tags:
- cosign-release
- ${_GIT_TAG}
- ${_TOOL_ORG}
- ${_TOOL_REPO}

substitutions:
  _GIT_TAG: 'v1.23.45'
  _TOOL_ORG: 'honk'
  _TOOL_REPO: 'honk-repo'
  _STORAGE_LOCATION: 'honk'
  _KEY_RING: 'honk-ring'
  _KEY_NAME: 'honk-crypto'
  _KEY_VERSION: '1'
  _KEY_LOCATION: 'global'