mirror of
https://github.com/ossf/scorecard.git
synced 2024-09-11 00:45:36 +03:00
🌱 Signing scorecard images using cosign (#1970)
* --wip-- [skip ci]
* 🌱 Signing scorecard images using cosign
Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>
This commit is contained in:
parent
4a88dac00f
commit
0eeb0c20cd
17
.github/workflows/publishimage.yml
vendored
17
.github/workflows/publishimage.yml
vendored
@ -22,7 +22,7 @@ permissions:
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
- main
|
||||
env:
|
||||
GO_VERSION: 1.17.7
|
||||
|
||||
@ -30,22 +30,24 @@ jobs:
|
||||
unit-test:
|
||||
name: publishimage
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
COSIGN_EXPERIMENTAL: "true"
|
||||
steps:
|
||||
- name: Harden Runner
|
||||
uses: step-security/harden-runner@248ae51c2e8cc9622ecf50685c8bf7150c6e8813 # v1
|
||||
uses: step-security/harden-runner@248ae51c2e8cc9622ecf50685c8bf7150c6e8813
|
||||
with:
|
||||
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
|
||||
|
||||
- name: Clone the code
|
||||
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v2.3.4
|
||||
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- name: Setup Go
|
||||
uses: actions/setup-go@b22fbbc2921299758641fab08929b4ac52b32923 # v2.2.0
|
||||
uses: actions/setup-go@b22fbbc2921299758641fab08929b4ac52b32923
|
||||
with:
|
||||
go-version: ${{ env.GO_VERSION }}
|
||||
- name: install ko
|
||||
uses: imjasonh/setup-ko@2c3450ca27f6e6f2b02e72a40f2163c281a1f675 # v0.4
|
||||
uses: imjasonh/setup-ko@2c3450ca27f6e6f2b02e72a40f2163c281a1f675
|
||||
- name: publishimage
|
||||
uses: nick-invision/retry@7f8f3d9f0f62fe5925341be21c2e8314fd4f7c7c
|
||||
with:
|
||||
@ -56,3 +58,8 @@ jobs:
|
||||
go env -w GOFLAGS=-mod=mod
|
||||
make install
|
||||
make scorecard-ko
|
||||
- name: Install Cosign
|
||||
uses: sigstore/cosign-installer@f700e6fbbab82f6897758a3af7a8dede4e308656
|
||||
- name: Sign image
|
||||
run: |
|
||||
cosign sign ghcr.io/${{github.repository_owner}}/scorecard/v4:${{ github.sha }}
|
||||
|
Loading…
Reference in New Issue
Block a user