Mirrored_Repos/InvenTree
1
0
Fork 0
mirror of https://github.com/inventree/InvenTree synced 2024-08-30 18:33:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

[FR] Sign artifacts with sigstore (#3347)

Browse Source 
Fixes #3077
This commit is contained in:
Matthias Mair 2022-07-20 08:20:58 +02:00 committed by GitHub
parent afcd60b387
commit dbbdaf39c7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
.github/workflows/docker.yaml vendored
View File

@ -26,7 +26,8 @@ jobs:
# Build the docker image # Build the docker image
build: build:
runs-on: ubuntu-latest runs-on: ubuntu-latest
permissions:
id-token: write
env: env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@ -56,13 +57,19 @@ jobs:
- name: Set up Docker Buildx - name: Set up Docker Buildx
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request'
uses: docker/setup-buildx-action@v1 uses: docker/setup-buildx-action@v1
- name: Set up cosign
uses: sigstore/cosign-installer@48866aa521d8bf870604709cd43ec2f602d03ff2
- name: Login to Dockerhub - name: Login to Dockerhub
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request'
uses: docker/login-action@v1 uses: docker/login-action@v1
with: with:
username: ${{ secrets.DOCKER_USERNAME }} username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }} password: ${{ secrets.DOCKER_PASSWORD }}
- name: Extract Docker metadata
id: meta
uses: docker/metadata-action@69f6fc9d46f2f8bf0d5491e4aabe0bb8c6a4678a
- name: Build and Push - name: Build and Push
id: build-and-push
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request'
uses: docker/build-push-action@v2 uses: docker/build-push-action@v2
with: with:
@ -74,6 +81,10 @@ jobs:
build-args: | build-args: |
commit_hash=${{ env.git_commit_hash }} commit_hash=${{ env.git_commit_hash }}
commit_date=${{ env.git_commit_date }} commit_date=${{ env.git_commit_date }}
- name: Sign the published image
env:
COSIGN_EXPERIMENTAL: "true"
run: cosign sign ${{ steps.meta.outputs.tags }}@${{ steps.build-and-push.outputs.digest }}
- name: Push to Stable Branch - name: Push to Stable Branch
uses: ad-m/github-push-action@master uses: ad-m/github-push-action@master
if: env.stable_release == 'true' if: env.stable_release == 'true'