XXX Test ko

Author: AlCutter

.github/workflows/release.yml

@@ -0,0 +1,59 @@
+name: Release
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - 'main'
+
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+        with:
+          go-version-file: go.mod
+      - name: Install ko
+        uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9.0
+      - name: Install cosign
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+      - name: Install syft
+        uses: anchore/sbom-action/download-syft@8e94d75ddd33f69f691467e42275782e4bfefe84 # v0.20.9
+      - name: Login to GHCR
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and publish images
+        id: ko
+        run: |
+          images=$(ko publish \
+            --platform=linux/amd64,linux/arm64 \
+            --tags=${{ github.sha }} \
+            --bare \
+            github.com/transparency-dev/tesseract/cmd/tesseract/posix \
+            github.com/transparency-dev/tesseract/cmd/tesseract/aws \
+            github.com/transparency-dev/tesseract/cmd/tesseract/gcp \
+            github.com/transparency-dev/tesseract/cmd/fsck)
+          echo "images=$images" >> $GITHUB_OUTPUT
+        env:
+          #KO_DOCKER_REPO: ghcr.io/${{ github.repository_owner }}/tesseract
+          KO_DOCKER_REPO: ghcr.io/alcutter/tesseract
+      - name: Sign images
+        run: |
+          cosign sign --yes ${{ steps.ko.outputs.images }}
+      - name: Generate SBOM and attest
+        run: |
+          for image in ${{ steps.ko.outputs.images }}; do
+            syft_json_path="sbom-${image//[^a-zA-Z0-9]/-}.json"
+            syft generate "${image}" -o json > "${syft_json_path}"
+            cosign attest --yes --predicate "${syft_json_path}" --type "https://spdx.dev/Document" "${image}"
+          done