diff options
| author | Mohammed Al Sahaf <msaa1990@gmail.com> | 2022-09-03 03:37:10 +0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-09-03 03:37:10 +0300 |
| commit | d6b3c7d2623d9a809abda367fb93dc48b0ba7d7c (patch) | |
| tree | cfd539965a6780920d385b9567067252b494988e | |
| parent | 66476d8c8f6010f19fb65bac7758c6fd2824e231 (diff) | |
ci: generate SBOM and sign artifacts using cosign (#4910)
* ci: sign artifacts using cosign
* include SBOM
| -rw-r--r-- | .github/workflows/release.yml | 10 | ||||
| -rw-r--r-- | .goreleaser.yml | 11 |
2 files changed, 19 insertions, 2 deletions
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2a2292a..d67f875 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -99,7 +99,14 @@ jobs: key: ${{ runner.os }}-go${{ matrix.go }}-release-${{ hashFiles('**/go.sum') }} restore-keys: | ${{ runner.os }}-go${{ matrix.go }}-release - + - name: Install Cosign + uses: sigstore/cosign-installer@main + - name: Cosign version + run: cosign version + - name: Install Syft + uses: anchore/sbom-action/download-syft@main + - name: Syft version + run: syft version # GoReleaser will take care of publishing those artifacts into the release - name: Run GoReleaser uses: goreleaser/goreleaser-action@v2 @@ -109,6 +116,7 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} TAG: ${{ steps.vars.outputs.version_tag }} + COSIGN_EXPERIMENTAL: 1 # Only publish on non-special tags (e.g. non-beta) # We will continue to push to Gemfury for the foreseeable future, although diff --git a/.goreleaser.yml b/.goreleaser.yml index f0e2615..d4f786d 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -62,9 +62,18 @@ builds: goarm: "5" flags: - -trimpath + - -mod=readonly ldflags: - -s -w - +signs: + - cmd: cosign + signature: "${artifact}.sig" + args: ["sign-blob", "--oidc-issuer=https://token.actions.githubusercontent.com", "--output=${signature}", "${artifact}"] + artifacts: all +sboms: + - artifacts: binary + cmd: syft + args: ["$artifact", "--file", "$sbom", "--output", "cyclonedx-json"] archives: - format_overrides: - goos: windows |