mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-09-08 15:41:15 +02:00
41 lines
1.4 KiB
YAML
41 lines
1.4 KiB
YAML
name: Sign container images
|
|
description: >
|
|
Keyless cosign signature on each image, then a verification pass against the
|
|
identity the signature should carry, so a misconfigured job fails here and not
|
|
on someone's cluster. That identity is the calling workflow's own,
|
|
https://github.com/<owner>/<repo>/.github/workflows/<file>@<ref>.
|
|
The calling job needs `id-token: write` and a registry login for every image.
|
|
|
|
inputs:
|
|
images:
|
|
description: Image references by digest (name@sha256:...), whitespace separated.
|
|
required: true
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Install cosign
|
|
uses: sigstore/cosign-installer@v4.1.2
|
|
|
|
- name: Sign
|
|
shell: bash
|
|
env:
|
|
IMAGES: ${{ inputs.images }}
|
|
run: |
|
|
set -euo pipefail
|
|
# The .sig tag layout: the OCI-referrer bundle cosign 3 writes by default
|
|
# is not read by the Kyverno and policy-controller releases in use today.
|
|
# Its signing config only supports bundles, so disable that path too.
|
|
cosign sign --yes --recursive --new-bundle-format=false --use-signing-config=false $IMAGES
|
|
|
|
- name: Verify
|
|
shell: bash
|
|
env:
|
|
IMAGES: ${{ inputs.images }}
|
|
run: |
|
|
set -euo pipefail
|
|
cosign verify \
|
|
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
|
|
--certificate-identity "https://github.com/$GITHUB_WORKFLOW_REF" \
|
|
$IMAGES
|