diff options
| author | Mohammed Al Sahaf <msaa1990@gmail.com> | 2022-09-03 03:37:10 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-09-03 03:37:10 +0300 |
| commit | d6b3c7d2623d9a809abda367fb93dc48b0ba7d7c (patch) | |
| tree | cfd539965a6780920d385b9567067252b494988e /.github | |
| parent | 66476d8c8f6010f19fb65bac7758c6fd2824e231 (diff) | |
ci: generate SBOM and sign artifacts using cosign (#4910)
* ci: sign artifacts using cosign
* include SBOM
Diffstat (limited to '.github')
| -rw-r--r-- | .github/workflows/release.yml | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2a2292a..d67f875 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -99,7 +99,14 @@ jobs: key: ${{ runner.os }}-go${{ matrix.go }}-release-${{ hashFiles('**/go.sum') }} restore-keys: | ${{ runner.os }}-go${{ matrix.go }}-release - + - name: Install Cosign + uses: sigstore/cosign-installer@main + - name: Cosign version + run: cosign version + - name: Install Syft + uses: anchore/sbom-action/download-syft@main + - name: Syft version + run: syft version # GoReleaser will take care of publishing those artifacts into the release - name: Run GoReleaser uses: goreleaser/goreleaser-action@v2 @@ -109,6 +116,7 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} TAG: ${{ steps.vars.outputs.version_tag }} + COSIGN_EXPERIMENTAL: 1 # Only publish on non-special tags (e.g. non-beta) # We will continue to push to Gemfury for the foreseeable future, although |