Christian Manivong
e7ef8fe073
CI / Tests, lint (push) Successful in 9s
netork's release joins an arm64 image to the amd64 one its dev build already signed and attested, under a new index. ATTEST_PLATFORMS (the sign action's attest-platforms) signs the new index and every platform behind it, and attests only the ones named.
35 lines
1.2 KiB
YAML
35 lines
1.2 KiB
YAML
name: Sign an image
|
|
description: >-
|
|
Sign a pushed image and every platform image behind it with netOrk's key, and
|
|
attach what each was judged by (bin/sign.sh). The caller passes the secrets
|
|
COSIGN_PRIVATE_KEY_B64 and COSIGN_PASSWORD as env of this step.
|
|
inputs:
|
|
ref:
|
|
description: The pushed image, <image>@<digest>
|
|
required: true
|
|
dir:
|
|
description: The judge action's results, cis-<arch>.json and sbom-<arch>.cdx.json
|
|
default: attest
|
|
expect-platforms:
|
|
description: The platforms the reference must hold, e.g. "amd64 arm64"; empty takes what is there
|
|
default: ""
|
|
attest-platforms:
|
|
description: >-
|
|
The platforms to attest, e.g. "arm64"; empty attests every one. A release
|
|
index joins a new platform to one already attested.
|
|
default: ""
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Install cosign
|
|
shell: bash
|
|
run: bash "${{ github.action_path }}/../../bin/install-cosign.sh"
|
|
- name: Sign and attest
|
|
shell: bash
|
|
env:
|
|
REF: ${{ inputs.ref }}
|
|
DIR: ${{ inputs.dir }}
|
|
EXPECT_PLATFORMS: ${{ inputs.expect-platforms }}
|
|
ATTEST_PLATFORMS: ${{ inputs.attest-platforms }}
|
|
run: bash "${{ github.action_path }}/../../bin/sign.sh" "$REF" "$DIR"
|