Christian Manivong
d139d66c3d
CI / Tests, lint (push) Successful in 18s
The CIS gate, the SBOM, the cosign signature and the matcher's verdict lived in NetOrk/base-os, the head of the chain. Every link below it -- base-python, engine, ui, satellite, the service images -- needs the same, so the tools move here, and every image repository pins them by commit. - image_tools: cis.py, cis_os.sh, sbom.py and verify.py from base-os. The image's own repository holds its cis.toml and packages.allow; both default to the working directory. - bin/sign.sh signs whatever platforms a reference holds: base-os's index of amd64 and arm64 (EXPECT_PLATFORMS) or a dev image's single manifest (image_tools/platforms.py). - bin/verify-base.sh checks every FROM image of a Dockerfile against cosign.pub before a build; one without a digest is refused (image_tools/dockerfile.py). - bin/install-cosign.sh installs cosign v3.1.3 for amd64 and arm64 runners, checked against the release checksums. - actions/verify-base, judge, sign wrap them for the workflows. - cosign.pub is the public half of the COSIGN_PRIVATE_KEY_B64 org secret, the key rotated on 2026-10-22.
29 lines
1000 B
YAML
29 lines
1000 B
YAML
name: Sign an image
|
|
description: >-
|
|
Sign a pushed image and every platform image behind it with netOrk's key, and
|
|
attach what each was judged by (bin/sign.sh). The caller passes the secrets
|
|
COSIGN_PRIVATE_KEY_B64 and COSIGN_PASSWORD as env of this step.
|
|
inputs:
|
|
ref:
|
|
description: The pushed image, <image>@<digest>
|
|
required: true
|
|
dir:
|
|
description: The judge action's results, cis-<arch>.json and sbom-<arch>.cdx.json
|
|
default: attest
|
|
expect-platforms:
|
|
description: The platforms the reference must hold, e.g. "amd64 arm64"; empty takes what is there
|
|
default: ""
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Install cosign
|
|
shell: bash
|
|
run: bash "${{ github.action_path }}/../../bin/install-cosign.sh"
|
|
- name: Sign and attest
|
|
shell: bash
|
|
env:
|
|
REF: ${{ inputs.ref }}
|
|
DIR: ${{ inputs.dir }}
|
|
EXPECT_PLATFORMS: ${{ inputs.expect-platforms }}
|
|
run: bash "${{ github.action_path }}/../../bin/sign.sh" "$REF" "$DIR"
|