Skip to content

Commit

Permalink
Update ci workflow for provenance on multi platform containers
Browse files Browse the repository at this point in the history
Signed-off-by: Marco Franssen <[email protected]>
  • Loading branch information
marcofranssen committed Jan 26, 2022
1 parent b085e71 commit ad6f73f
Showing 1 changed file with 19 additions and 9 deletions.
28 changes: 19 additions & 9 deletions .github/workflows/ci.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -64,8 +64,7 @@ jobs:
name: release
needs: [build]
outputs:
container_digest: ${{ steps.container_info.outputs.container_digest }}
container_tags: ${{ steps.container_info.outputs.container_tags }}
container_info: ${{ steps.container_info.outputs.container_info }}
container_repos: ${{ steps.container_info.outputs.container_repos }}

runs-on: ubuntu-20.04
Expand Down Expand Up @@ -130,10 +129,20 @@ jobs:
id: container_info
if: startsWith(github.ref, 'refs/tags/')
run: |
export CONTAINER_DIGEST=$(make container-digest GITHUB_REF=${{ github.ref_name }})
echo "::set-output name=container_digest::$CONTAINER_DIGEST"
echo "::set-output name=container_tags::$(make container-tags CONTAINER_DIGEST="${CONTAINER_DIGEST}" | paste -s -d ',' -)"
echo "::set-output name=container_repos::$(make container-repos CONTAINER_DIGEST="${CONTAINER_DIGEST}" | jq --raw-input . | jq --slurp -c)"
function digest_tags {
while IFS= read -r line ; do
jq -n "{digest: \"$line\", tags: \$ARGS.positional}" --args $(make container-tags CONTAINER_DIGEST=$line)
done <<< "$(make manifest-digest GITHUB_REF=${{ github.ref_name }})"
}
CONTAINER_INFO="$(digest_tags | jq --slurp . -c)"
CONTAINER_DIGEST="$(echo "$CONTAINER_INFO" | jq --raw-output '.[0].digest')"
CONTAINER_REPOS="$(make container-repos CONTAINER_DIGEST="${CONTAINER_DIGEST}" | jq --raw-input . | jq --slurp -c)"
set | grep 'CONTAINER_'
echo "::set-output name=container_info::$CONTAINER_INFO"
echo "::set-output name=container_repos::$CONTAINER_REPOS"
- name: Logout from Container registries
if: ${{ always() }}
Expand All @@ -154,6 +163,7 @@ jobs:
strategy:
matrix:
repo: ${{ fromJSON(needs.release.outputs.container_repos) }}
container: ${{ fromJSON(needs.release.outputs.container_info) }}

steps:
- name: Install cosign
Expand All @@ -166,7 +176,7 @@ jobs:
with:
command: generate
subcommand: container
arguments: --repository ${{ matrix.repo }} --digest ${{ needs.release.outputs.container_digest }} --tags ${{ needs.release.outputs.container_tags }}
arguments: --repository ${{ matrix.repo }} --digest ${{ matrix.container.digest }} --tags ${{ join(matrix.container.tags, ',') }}
env:
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

Expand All @@ -183,14 +193,14 @@ jobs:
- name: Attach provenance to image
run: |
echo '${{ secrets.COSIGN_PRIVATE_KEY }}' > cosign.key
cosign attest --predicate provenance-predicate.json --type slsaprovenance --key cosign.key ${{ matrix.repo }}@${{ needs.release.outputs.container_digest }}
cosign attest --predicate provenance-predicate.json --type slsaprovenance --key cosign.key ${{ matrix.repo }}@${{ matrix.container.digest }}
env:
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}

- name: Verify attestation
run: |
echo '${{ secrets.COSIGN_PUBLIC_KEY }}' > cosign.pub
cosign verify-attestation --key cosign.pub ${{ matrix.repo }}@${{ needs.release.outputs.container_digest }}
cosign verify-attestation --key cosign.pub ${{ matrix.repo }}@${{ matrix.container.digest }}
- name: Logout from Container registries
if: ${{ always() }}
Expand Down

0 comments on commit ad6f73f

Please sign in to comment.