Skip to content

Commit a1fcbc9

Browse files
crazy-maxcrazy-max
committed
build: set cosign version, verify commands and artifact name as outputs
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
1 parent ec89399 commit a1fcbc9

File tree

3 files changed

+131
-1
lines changed

3 files changed

+131
-1
lines changed

‎.github/workflows/.test.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,39 @@ jobs:
5959
username: ${{ secrets.AWS_ACCESS_KEY_ID }}
6060
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
6161
62+
build-aws-verify:
63+
runs-on: ubuntu-latest
64+
if: ${{ github.event_name != 'pull_request' }}
65+
needs:
66+
- build-aws
67+
steps:
68+
-
69+
name: Install Cosign
70+
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
71+
with:
72+
cosign-release: ${{ needs.build-aws.outputs.cosign-version }}
73+
-
74+
name: Login to registry
75+
uses: docker/login-action@v3
76+
with:
77+
registry: public.ecr.aws
78+
username: ${{ secrets.AWS_ACCESS_KEY_ID }}
79+
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
80+
-
81+
name: Verify signatures
82+
uses: actions/github-script@v8
83+
env:
84+
INPUT_COSIGN-VERSION: ${{ needs.build-aws.outputs.cosign-version }}
85+
INPUT_COSIGN-VERIFY-COMMANDS: ${{ needs.build-aws.outputs.cosign-verify-commands }}
86+
with:
87+
script: |
88+
const cosignVersion = core.getInput('cosign-version');
89+
core.info(`Cosign version used by Docker GitHub Builder: ${cosignVersion}`);
90+
const cosignVerifyCommands = core.getMultilineInput('cosign-verify-commands');
91+
for (const cmd of cosignVerifyCommands) {
92+
await exec.exec(cmd);
93+
}
94+
6295
build-ghcr:
6396
uses: ./.github/workflows/build.yml
6497
permissions:
@@ -154,3 +187,34 @@ jobs:
154187
build-file: test/hello.Dockerfile
155188
build-sbom: true
156189
build-platforms: linux/amd64,linux/arm64
190+
191+
build-local-verify:
192+
runs-on: ubuntu-latest
193+
if: ${{ github.event_name != 'pull_request' }}
194+
needs:
195+
- build-local
196+
steps:
197+
-
198+
name: Install Cosign
199+
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
200+
with:
201+
cosign-release: ${{ needs.build-local.outputs.cosign-version }}
202+
-
203+
name: Download artifact
204+
uses: actions/download-artifact@v5
205+
with:
206+
name: ${{ needs.build-local.outputs.artifact-name }}
207+
-
208+
name: Verify signatures
209+
uses: actions/github-script@v8
210+
env:
211+
INPUT_COSIGN-VERSION: ${{ needs.build-local.outputs.cosign-version }}
212+
INPUT_COSIGN-VERIFY-COMMANDS: ${{ needs.build-local.outputs.cosign-verify-commands }}
213+
with:
214+
script: |
215+
const cosignVersion = core.getInput('cosign-version');
216+
core.info(`Cosign version used by Docker GitHub Builder: ${cosignVersion}`);
217+
const cosignVerifyCommands = core.getMultilineInput('cosign-verify-commands');
218+
for (const cmd of cosignVerifyCommands) {
219+
await exec.exec(cmd);
220+
}

‎.github/workflows/build.yml‎

Lines changed: 38 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -108,15 +108,30 @@ on:
108108
github-token:
109109
description: "GitHub Token used to authenticate against a repository for Git context"
110110
required: false
111+
outputs:
112+
cosign-version:
113+
description: Cosign version used for verification
114+
value: ${{ jobs.build.outputs.cosign-version }}
115+
cosign-verify-commands:
116+
description: Cosign verify commands
117+
value: ${{ jobs.build.outputs.cosign-verify-commands }}
118+
artifact-name:
119+
description: Name of the uploaded artifact (for local output)
120+
value: ${{ jobs.build.outputs.artifact-name }}
111121

112122
env:
113123
DOCKER_ACTIONS_TOOLKIT_MODULE: "@docker/actions-toolkit@0.67.0"
114124
COSIGN_VERSION: "v3.0.2"
115125
LOCAL_EXPORT_DIR: "/tmp/buildx-output"
126+
LOCAL_ARTIFACT_NAME: "docker-github-builder-assets"
116127

117128
jobs:
118129
build:
119130
runs-on: ubuntu-latest
131+
outputs:
132+
cosign-version: ${{ env.COSIGN_VERSION }}
133+
cosign-verify-commands: ${{ steps.signing-attestation-manifests.outputs.verify-commands || steps.signing-local-artifacts.outputs.verify-commands }}
134+
artifact-name: ${{ env.LOCAL_ARTIFACT_NAME }}
120135
permissions:
121136
contents: read
122137
id-token: write # needed for signing the images with GitHub OIDC Token
@@ -266,6 +281,7 @@ jobs:
266281
await cosign.printVersion();
267282
-
268283
name: Signing attestation manifests
284+
id: signing-attestation-manifests
269285
if: ${{ inputs.output == 'registry' }}
270286
uses: actions/github-script@v8
271287
env:
@@ -288,8 +304,19 @@ jobs:
288304
{ certificateIdentityRegexp: `^https://github.com/docker/github-builder-experimental/.github/workflows/build.yml.*$` },
289305
signResults
290306
);
307+
308+
await core.group(`Verify commands`, async () => {
309+
const verifyCommands = [];
310+
for (const [attestationRef, verifyResult] of Object.entries(verifyResults)) {
311+
const cmd = `cosign ${verifyResult.cosignArgs.join(' ')} ${attestationRef}`;
312+
core.info(cmd);
313+
verifyCommands.push(cmd);
314+
}
315+
core.setOutput('verify-commands', verifyCommands.join('\n'));
316+
});
291317
-
292318
name: Signing local artifacts
319+
id: signing-local-artifacts
293320
if: ${{ inputs.output == 'local' }}
294321
uses: actions/github-script@v8
295322
env:
@@ -309,6 +336,16 @@ jobs:
309336
{ certificateIdentityRegexp: `^https://github.com/docker/github-builder-experimental/.github/workflows/build.yml.*$` },
310337
signResults
311338
);
339+
340+
await core.group(`Verify commands`, async () => {
341+
const verifyCommands = [];
342+
for (const [artifactPath, verifyResult] of Object.entries(verifyResults)) {
343+
const cmd = `cosign ${verifyResult.cosignArgs.join(' ')} --bundle ${path.relative(inplocalExportDir, verifyResult.bundlePath)} ${path.relative(inplocalExportDir, artifactPath)}`;
344+
core.info(cmd);
345+
verifyCommands.push(cmd);
346+
}
347+
core.setOutput('verify-commands', verifyCommands.join('\n'));
348+
});
312349
-
313350
name: Create manifest
314351
if: ${{ inputs.output == 'registry' }}
@@ -343,6 +380,6 @@ jobs:
343380
if: ${{ inputs.output == 'local' }}
344381
uses: actions/upload-artifact@v5
345382
with:
346-
name: docker-github-builder-assets
383+
name: ${{ env.LOCAL_ARTIFACT_NAME }}
347384
path: ${{ env.LOCAL_EXPORT_DIR }}
348385
if-no-files-found: error

‎README.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,35 @@ on:
5151
- registry: docker.io
5252
username: ${{ vars.DOCKERHUB_USERNAME }}
5353
password: ${{ secrets.DOCKERHUB_TOKEN }}
54+
55+
build-verify:
56+
runs-on: ubuntu-latest
57+
if: ${{ github.event_name != 'pull_request' }}
58+
needs:
59+
- build
60+
steps:
61+
-
62+
name: Install Cosign
63+
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
64+
with:
65+
cosign-release: ${{ needs.build-aws.outputs.cosign-version }}
66+
-
67+
name: Login to registry
68+
uses: docker/login-action@v3
69+
with:
70+
registry: docker.io
71+
username: ${{ vars.DOCKERHUB_USERNAME }}
72+
password: ${{ secrets.DOCKERHUB_TOKEN }}
73+
-
74+
name: Verify signatures
75+
uses: actions/github-script@v8
76+
env:
77+
INPUT_COSIGN-VERIFY-COMMANDS: ${{ needs.build-aws.outputs.cosign-verify-commands }}
78+
with:
79+
script: |
80+
for (const cmd of core.getMultilineInput('cosign-verify-commands')) {
81+
await exec.exec(cmd);
82+
}
5483
```
5584
5685
You can find the list of available inputs in [`.github/workflows/build.yml`](.github/workflows/build.yml).

0 commit comments

Comments
 (0)