Christian Manivong
ae39af4665
CI / Tests, lint (push) Successful in 12s
- image_tools/bump.py from base-os, with an action. base-python used it from
a pinned checkout of base-os, with the bot's token; one place serves both.
A dependent whose workflow does not exist (netork's ui-nightly.yml, on
2026-10-22) is named and the others go on; the run fails at the end, as
for a repository the token cannot see. bump_all holds that loop, tested.
- verify-base takes refs besides Dockerfiles: base-python builds FROM
${BASE_OS}, which its nightly sets, and copies CPython from Docker's
python:3.12-slim, which is not signed with netOrk's key.
40 lines
1.3 KiB
YAML
40 lines
1.3 KiB
YAML
name: Verify the base images
|
|
description: >-
|
|
Every image the Dockerfiles build on, and every image named in refs, is
|
|
signed with netOrk's key, checked before the build (NetOrk/netork#1390,
|
|
bin/verify-base.sh, bin/verify-signature.sh). Give one or both.
|
|
inputs:
|
|
dockerfiles:
|
|
description: Dockerfiles whose FROM images to verify, separated by spaces
|
|
default: ""
|
|
refs:
|
|
description: >-
|
|
Images to verify, <image>@<digest>, separated by spaces: for a FROM the
|
|
Dockerfile only knows as an argument
|
|
default: ""
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Install cosign
|
|
shell: bash
|
|
run: bash "${{ github.action_path }}/../../bin/install-cosign.sh"
|
|
- name: Verify
|
|
shell: bash
|
|
env:
|
|
DOCKERFILES: ${{ inputs.dockerfiles }}
|
|
REFS: ${{ inputs.refs }}
|
|
# The lists split on spaces on purpose.
|
|
run: |
|
|
if [ -z "$DOCKERFILES$REFS" ]; then
|
|
echo "verify-base: give dockerfiles, refs or both" >&2
|
|
exit 1
|
|
fi
|
|
if [ -n "$DOCKERFILES" ]; then
|
|
# shellcheck disable=SC2086
|
|
bash "${{ github.action_path }}/../../bin/verify-base.sh" $DOCKERFILES
|
|
fi
|
|
if [ -n "$REFS" ]; then
|
|
# shellcheck disable=SC2086
|
|
bash "${{ github.action_path }}/../../bin/verify-signature.sh" $REFS
|
|
fi
|