66 COSIGN_EXPERIMENTAL : 1
77 REGISTRY : ghcr.io
88 IMAGE_NAME : ${{ github.repository }}
9- VERSION : 0.5.1
9+ VERSION : 0.6.0
1010
1111jobs :
1212 build :
1616 contents : write
1717 packages : write
1818 outputs :
19- image-release : ${{ steps.image-info.outputs.release }}
19+ image-name : ${{ steps.image-info.outputs.image_name }}
20+ image-digest : ${{ steps.image-info.outputs.image_digest }}
2021 steps :
2122 - name : Checkout source code
2223 uses : actions/checkout@v3.1.0
5657 package_file=repo/package-repository.yml
5758 image_release=$(yq '.spec.fetch.imgpkgBundle.image' ${package_file})
5859 echo "IMAGE_RELEASE=${image_release}" >> $GITHUB_ENV
59- echo "release=${image_release}" >> $GITHUB_OUTPUT
60+
61+ echo "image_name=$(echo ${image_release} | cut -d'@' -f1)" >> $GITHUB_OUTPUT
62+ echo "image_digest=$(echo ${image_release} | cut -d'@' -f2)" >> $GITHUB_OUTPUT
6063
6164 - name : Add additional tags to OCI image
6265 run : |
8184 packages : write
8285 id-token : write
8386 env :
84- IMAGE_RELEASE : ${{ needs.build.outputs.image-release }}
87+ IMAGE_NAME : ${{ needs.build.outputs.image-name }}
88+ IMAGE_DIGEST : ${{ needs.build.outputs.image-digest }}
8589 steps :
8690 - name : Install Cosign
8791 uses : sigstore/cosign-installer@v2.8.1
@@ -95,49 +99,63 @@ jobs:
9599
96100 - name : Sign image
97101 run : |
98- cosign sign "${IMAGE_RELEASE }"
102+ cosign sign "${IMAGE_NAME}@${IMAGE_DIGEST }"
99103
100104 provenance :
101- name : Provenance
102- runs-on : ubuntu-22.04
103105 needs : [build,sign]
104106 permissions :
105- packages : write
107+ actions : read
106108 id-token : write
107- env :
108- IMAGE_RELEASE : ${{ needs.build.outputs.image-release }}
109- PROVENANCE_FILE : provenance.att
110- steps :
111- - name : Install Cosign
112- uses : sigstore/cosign-installer@v2.8.1
109+ packages : write
110+ uses : slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.4.0
111+ with :
112+ image : ${{ needs.build.outputs.image-name }}
113+ digest : ${{ needs.build.outputs.image-digest }}
114+ registry-username : ${{ inputs.registry-username }}
115+ secrets :
116+ registry-password : ${{ secrets.GITHUB_TOKEN }}
117+
118+ # provenance:
119+ # name: Provenance
120+ # runs-on: ubuntu-22.04
121+ # needs: [build,sign]
122+ # permissions:
123+ # packages: write
124+ # id-token: write
125+ # env:
126+ # IMAGE_RELEASE: ${{ needs.build.outputs.image-release }}
127+ # PROVENANCE_FILE: provenance.att
128+ # steps:
129+ # - name: Install Cosign
130+ # uses: sigstore/cosign-installer@v2.8.1
113131
114- - name : Log into container registry
115- uses : redhat-actions/podman-login@v1.4
116- with :
117- username : ${{ github.actor }}
118- password : ${{ secrets.GITHUB_TOKEN }}
119- registry : ${{ env.REGISTRY }}
132+ # - name: Log into container registry
133+ # uses: redhat-actions/podman-login@v1.4
134+ # with:
135+ # username: ${{ github.actor }}
136+ # password: ${{ secrets.GITHUB_TOKEN }}
137+ # registry: ${{ env.REGISTRY }}
120138
121- - name : Extract digest
122- run : |
123- digest=$(echo ${IMAGE_RELEASE} | cut -d "@" -f2)
124- echo "IMAGE_DIGEST=${digest}" >> $GITHUB_ENV
139+ # - name: Extract digest
140+ # run: |
141+ # digest=$(echo ${IMAGE_RELEASE} | cut -d "@" -f2)
142+ # echo "IMAGE_DIGEST=${digest}" >> $GITHUB_ENV
125143
126- name : Generate provenance
127- uses : philips-labs/slsa-provenance-action@v0.7.2
128- with :
129- command : generate
130- subcommand : container
131- arguments : --repository ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} --tags ${{ env.VERSION }} --digest ${{ env.IMAGE_DIGEST }} --output-path ${{ env.PROVENANCE_FILE }}
132- env :
133- COSIGN_EXPERIMENTAL : 0
144+ # - name: Generate provenance
145+ # uses: philips-labs/slsa-provenance-action@v0.7.2
146+ # with:
147+ # command: generate
148+ # subcommand: container
149+ # arguments: --repository ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} --tags ${{ env.VERSION }} --digest ${{ env.IMAGE_DIGEST }} --output-path ${{ env.PROVENANCE_FILE }}
150+ # env:
151+ # COSIGN_EXPERIMENTAL: 0
134152
135- - name : Attach provenance
136- run : |
137- jq '.predicate' "${PROVENANCE_FILE}" > provenance-predicate.att
138- cosign attest --predicate provenance-predicate.att --type slsaprovenance "${IMAGE_RELEASE}"
153+ # - name: Attach provenance
154+ # run: |
155+ # jq '.predicate' "${PROVENANCE_FILE}" > provenance-predicate.att
156+ # cosign attest --predicate provenance-predicate.att --type slsaprovenance "${IMAGE_RELEASE}"
139157
140- uses : actions/upload-artifact@v3.1.1
141- with :
142- name : provenance.att
143- path : ${{ env.PROVENANCE_FILE }}
158+ # - uses: actions/upload-artifact@v3.1.1
159+ # with:
160+ # name: provenance.att
161+ # path: ${{ env.PROVENANCE_FILE }}
0 commit comments