cosign/.github/workflows/build.yaml at main · Reality2byte/cosign · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
#
# Copyright 2021 The Sigstore Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: CI-Container-Build

on:
  push:
    paths:
      - '**'
      - '!**.md'
      - '!doc/**'
      - '!**.txt'
      - '!images/**'
      - '!LICENSE'
      - 'test/**'
    branches:
      - main
      - release-*

permissions: {}

jobs:
  build:
    name: build
    runs-on: ubuntu-latest

    if: github.repository == 'sigstore/cosign'

    permissions:
      id-token: write
      contents: read
      packages: write

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2

      - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
        with:
          go-version-file: 'go.mod'
          check-latest: true

      # will use the latest release available for ko
      - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9

      - name: Set up Cloud SDK
        uses: google-github-actions/auth@140bb5113ffb6b65a7e9b937a81fa96cf5064462 # v2.1.11
        with:
          workload_identity_provider: 'projects/498091336538/locations/global/workloadIdentityPools/githubactions/providers/sigstore-cosign'
          service_account: 'github-actions@projectsigstore.iam.gserviceaccount.com'

      - name: creds
        run: gcloud auth configure-docker --quiet

      - name: Login to GitHub Container Registry
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: containers-cosign
        run: make sign-ci-containers
        env:
          KO_PREFIX: ghcr.io/sigstore/cosign/cosign/ci
          COSIGN_PASSWORD: "${{secrets.COSIGN_PASSWORD}}"