Merge pull request #26817 from element-hq/gaelg/sign-images-cosign

Sign Docker images using cosign
This commit is contained in:
Ben Banfield-Zanin 2024-05-13 10:07:49 +00:00 committed by GitHub
commit e651330ff1
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -7,6 +7,9 @@ on:
# This job can take a while, and we have usage limits, so just publish develop only twice a day # This job can take a while, and we have usage limits, so just publish develop only twice a day
- cron: "0 7/12 * * *" - cron: "0 7/12 * * *"
concurrency: ${{ github.workflow }}-${{ github.ref_name }} concurrency: ${{ github.workflow }}-${{ github.ref_name }}
permissions:
id-token: write # needed for signing the images with GitHub OIDC Token
jobs: jobs:
buildx: buildx:
name: Docker Buildx name: Docker Buildx
@ -26,6 +29,9 @@ jobs:
with: with:
fetch-depth: 0 # needed for docker-package to be able to calculate the version fetch-depth: 0 # needed for docker-package to be able to calculate the version
- name: Install Cosign
uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3
- name: Prepare - name: Prepare
if: matrix.prepare if: matrix.prepare
run: ${{ matrix.prepare }} run: ${{ matrix.prepare }}
@ -58,6 +64,7 @@ jobs:
${{ matrix.flavor }} ${{ matrix.flavor }}
- name: Build and push - name: Build and push
id: build-and-push
uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5 uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5
with: with:
context: . context: .
@ -66,6 +73,17 @@ jobs:
tags: ${{ steps.meta.outputs.tags }} tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }} labels: ${{ steps.meta.outputs.labels }}
- name: Sign the images with GitHub OIDC Token
env:
DIGEST: ${{ steps.build-and-push.outputs.digest }}
TAGS: ${{ steps.meta.outputs.tags }}
run: |
images=""
for tag in ${TAGS}; do
images+="${tag}@${DIGEST} "
done
cosign sign --yes ${images}
- name: Update repo description - name: Update repo description
if: matrix.variant == 'vanilla' if: matrix.variant == 'vanilla'
uses: peter-evans/dockerhub-description@e98e4d1628a5f3be2be7c231e50981aee98723ae # v4 uses: peter-evans/dockerhub-description@e98e4d1628a5f3be2be7c231e50981aee98723ae # v4