[ci] Increase attestation verbosity

Signed-off-by: Vladimir Portnov <vladimir.portnov@flant.com>

Author: Taior

.werf/defines/trivyignore.tmpl

@@ -59,18 +59,33 @@ shell:
   - export TRANSIT_SECRET_ENGINE_PATH="$(cat /run/secrets/COSIGN_TRANSIT_SECRET_ENGINE_PATH)"
   - export ACTIONS_ID_TOKEN_REQUEST_TOKEN="$(cat /run/secrets/ACTIONS_ID_TOKEN_REQUEST_TOKEN)"
   - export ACTIONS_ID_TOKEN_REQUEST_URL="$(cat /run/secrets/ACTIONS_ID_TOKEN_REQUEST_URL)"
-  - |
-    ACTIONS_ID_TOKEN=$(jq -r .value <<< $(curl -fsH "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=github-access-aud" )) \
-    VAULT_TOKEN="$(curl -X POST "${VAULT_ADDR}/v1/auth/github/login" -d '{"role":"'${COSIGN_AUTH_ROLE}'","jwt":"'${ACTIONS_ID_TOKEN}'"}' | jq -r '.auth.client_token')" \
-    cosign attest \
-      --replace \
-      --registry-username="${REGISTRY_USER}" \
-      --registry-password="${REGISTRY_PASSWORD}" \
-      --predicate /.trivyignore.yaml \
-      --type custom \
-      --key hashivault://${COSIGN_VAULT_KEY} \
-      --tlog-upload=false \
-      -y \
+  - >
+    export ACTIONS_ID_TOKEN=$(jq -r .value <<< $(curl -fsH "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=github-access-aud" ))
+  - >
+    if [ -n "${ACTIONS_ID_TOKEN}" ]; then
+      echo "Received Actions token";
+    else
+      echo "Actions token empty";
+    fi
+  - >
+    export VAULT_TOKEN="$(curl -fX POST "${VAULT_ADDR}/v1/auth/github/login" -d '{"role":"'${COSIGN_AUTH_ROLE}'","jwt":"'${ACTIONS_ID_TOKEN}'"}' | jq -r '.auth.client_token')"
+  - >
+    if [ -n "${VAULT_TOKEN}" ]; then
+      echo "Received Vault token";
+    else
+      echo "Vault token empty";
+    fi
+  - echo "Using predicate .trivyignore.yaml"
+  - >
+    cosign attest
+      --replace
+      --registry-username="${REGISTRY_USER}"
+      --registry-password="${REGISTRY_PASSWORD}"
+      --predicate /.trivyignore.yaml
+      --type custom
+      --key hashivault://${COSIGN_VAULT_KEY}
+      --tlog-upload=false
+      -y -d
       "${IMAGE_REPO}@${IMAGE_DIGEST}"
   {{- end }}
 {{- end }}

.werf/defines/vex.tmpl

@@ -65,18 +65,33 @@ shell:
   - export TRANSIT_SECRET_ENGINE_PATH="$(cat /run/secrets/COSIGN_TRANSIT_SECRET_ENGINE_PATH)"
   - export ACTIONS_ID_TOKEN_REQUEST_TOKEN="$(cat /run/secrets/ACTIONS_ID_TOKEN_REQUEST_TOKEN)"
   - export ACTIONS_ID_TOKEN_REQUEST_URL="$(cat /run/secrets/ACTIONS_ID_TOKEN_REQUEST_URL)"
-  - |
-    ACTIONS_ID_TOKEN=$(jq -r .value <<< $(curl -fsH "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=github-access-aud" )) \
-    VAULT_TOKEN="$(curl -X POST "${VAULT_ADDR}/v1/auth/github/login" -d '{"role":"'${COSIGN_AUTH_ROLE}'","jwt":"'${ACTIONS_ID_TOKEN}'"}' | jq -r '.auth.client_token')" \
-    cosign attest \
-      --replace \
-      --registry-username="${REGISTRY_USER}" \
-      --registry-password="${REGISTRY_PASSWORD}" \
-      --predicate /known_vulnerabilities.vex \
-      --type openvex \
-      --key hashivault://${COSIGN_VAULT_KEY} \
-      --tlog-upload=false \
-      -y \
+  - >
+    export ACTIONS_ID_TOKEN=$(jq -r .value <<< $(curl -fsH "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=github-access-aud" ))
+  - >
+    if [ -n "${ACTIONS_ID_TOKEN}" ]; then
+      echo "Received Actions token";
+    else
+      echo "Actions token empty";
+    fi
+  - >
+    export VAULT_TOKEN="$(curl -fX POST "${VAULT_ADDR}/v1/auth/github/login" -d '{"role":"'${COSIGN_AUTH_ROLE}'","jwt":"'${ACTIONS_ID_TOKEN}'"}' | jq -r '.auth.client_token')"
+  - >
+    if [ -n "${VAULT_TOKEN}" ]; then
+      echo "Received Vault token";
+    else
+      echo "Vault token empty";
+    fi
+  - echo "Using predicate known_vulnerabilities.vex"
+  - >
+    cosign attest
+      --replace
+      --registry-username="${REGISTRY_USER}"
+      --registry-password="${REGISTRY_PASSWORD}"
+      --predicate /known_vulnerabilities.vex
+      --type openvex
+      --key hashivault://${COSIGN_VAULT_KEY}
+      --tlog-upload=false
+      -y -d
       "${IMAGE_REPO}@${IMAGE_DIGEST}"
   {{- end }}
 {{- end }}