Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

23285 add attestation (#24604)

Browse Source
This commit is contained in:
Scott Gress
2024-12-10 16:02:08 -06:00
committed by GitHub
parent 324a269e22
commit 149e5b129f
2 changed files with 56 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/goreleaser-fleet.yaml
+36
View File
@@ -72,6 +72,7 @@ jobs:
popd
- name: Run GoReleaser
id: goreleaser
uses: goreleaser/goreleaser-action@f82d6c1c344bcacabba2c841718984797f664a6b
with:
distribution: goreleaser-pro
@@ -86,6 +87,41 @@ jobs:
APPLE_APP_STORE_CONNECT_KEY_ID: ${{ secrets.APPLE_APP_STORE_CONNECT_KEY_ID }}
APPLE_APP_STORE_CONNECT_ISSUER_ID: ${{ secrets.APPLE_APP_STORE_CONNECT_ISSUER_ID }}
- name: Attest binaries and archives
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
with:
subject-path: "dist/fleet*"
# Get the commit hash so we can get image digests
- name: Get the short commit hash
id: commit
run: echo "short_commit=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
# Get the image digests from the goreleaser artifacts
# Adapted from https://github.com/goreleaser/goreleaser/issues/4852#issuecomment-2122790132
- name: Get image digests
continue-on-error: true
id: image_digests
run: |
echo "digest_fleet=$(echo ${{ steps.goreleaser.outputs.artifacts }} | jq -r '.[]|select(.type == "Published Docker Image" and (.name | contains("fleetdm/fleet:${{ steps.commit.outputs.short_commit }}"))) | select(. != null)|.extra.Digest')" >> "$GITHUB_OUTPUT"
echo "digest_fleetctl=$(echo ${{ steps.goreleaser.outputs.artifacts }} | jq -r '.[]|select(.type == "Published Docker Image" and (.name | contains("fleetdm/fleetctl:${{ steps.commit.outputs.short_commit }}"))) | select(. != null)|.extra.Digest')" >> "$GITHUB_OUTPUT"
- name: Attest Fleet image
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
continue-on-error: true
with:
subject-digest: ${{steps.image_digests.outputs.digest_fleet}}
subject-name: "fleetdm/fleet:${{ steps.commit.outputs.short_commit }}"
push-to-registry: true
- name: Attest FleetCtl image
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
continue-on-error: true
with:
subject-digest: ${{steps.image_digests.outputs.digest_fleetctl}}
subject-name: "fleetdm/fleetctl:${{ steps.commit.outputs.short_commit }}"
push-to-registry: true
- name: Get tag
run: |
echo "TAG=$(git describe --tags | sed -e "s/^fleet-//")" >> $GITHUB_OUTPUT
.github/workflows/goreleaser-orbit.yaml
+20
View File
@@ -62,6 +62,11 @@ jobs:
AC_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
CODESIGN_IDENTITY: 51049B247B25B3119FAE7E9C0CC4375A43E47237
- name: Attest binary
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
with:
subject-path: "dist/orbit-macos_darwin_all/orbit"
- name: Upload
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3
with:
@@ -95,6 +100,11 @@ jobs:
- name: Run GoReleaser
run: go run github.com/goreleaser/goreleaser/v2@606c0e724fe9b980cd01090d08cbebff63cd0f72 release --verbose --clean --skip=publish -f orbit/goreleaser-linux.yml # v2.4.4
- name: Attest binary
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
with:
subject-path: "dist/orbit_linux_amd64_v1/orbit"
- name: Upload
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3
with:
@@ -128,6 +138,11 @@ jobs:
- name: Run GoReleaser
run: go run github.com/goreleaser/goreleaser/v2@606c0e724fe9b980cd01090d08cbebff63cd0f72 release --verbose --clean --skip=publish -f orbit/goreleaser-linux-arm64.yml # v2.4.4
- name: Attest binary
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
with:
subject-path: "dist/orbit_linux_arm64/orbit"
- name: Upload
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3
with:
@@ -161,6 +176,11 @@ jobs:
- name: Run GoReleaser
run: go run github.com/goreleaser/goreleaser/v2@606c0e724fe9b980cd01090d08cbebff63cd0f72 release --verbose --clean --skip=publish -f orbit/goreleaser-windows.yml # v2.4.4
- name: Attest binary
uses: actions/attest-build-provenance@619dbb2e03e0189af0c55118e7d3c5e129e99726 # v2.0
with:
subject-path: "dist/orbit_windows_amd64_v1/orbit.exe"
- name: Upload
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # 4.3.3
with: