Conversation
63c1dd5 to
562cc9d
Compare
Signed-off-by: cpanato <ctadeu@gmail.com>
|
ping @haydentherapper @bobcallaway |
| install-dir: | ||
| description: 'Where to install the cosign binary' | ||
| required: false | ||
| default: '$HOME/.cosign' |
There was a problem hiding this comment.
this might have a breaking impact on folks if they're hardcoded the path, perhaps we should include a comment in the changelog about this
There was a problem hiding this comment.
yes, we can add a comment and also bump the minor version of the action
| export install_dir="$RUNNER_TOOL_CACHE/cosign/${{ inputs.cosign-release }}/${{ runner.arch }}" | ||
|
|
||
| if command -v "$install_dir/cosign" &> /dev/null; then | ||
| echo "Found Cosign in the cache $RUNNER_TOOL_CACHE" |
There was a problem hiding this comment.
wdyt about printing the shasum of the binary that is found? I'm wondering about if someone were to "poison" the cache before our action is called, and we're simply just checking that a binary exists in that path instead of ensuring it is the "right" binary.
There was a problem hiding this comment.
sounds a great idea, will add another output
There was a problem hiding this comment.
the only other thought I have is to have the action to retain a full list of all checksums, and ensure the digest of the file matches our "database"
There was a problem hiding this comment.
If that is something we don't want, we can just set it as won't fix it and keep as is
this is most relevant to self hosted runners
4 participants
Summary
use RUNNER_TOOL_CACHE path to store cosign
Fixes: #183