ci: generate SBOM and sign artifacts using cosign (#4910)

* ci: sign artifacts using cosign

* include SBOM
This commit is contained in:
Mohammed Al Sahaf 2022-09-03 03:37:10 +03:00 committed by GitHub
parent 66476d8c8f
commit d6b3c7d262
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 19 additions and 2 deletions

View File

@ -99,7 +99,14 @@ jobs:
key: ${{ runner.os }}-go${{ matrix.go }}-release-${{ hashFiles('**/go.sum') }}
restore-keys: |
${{ runner.os }}-go${{ matrix.go }}-release
- name: Install Cosign
uses: sigstore/cosign-installer@main
- name: Cosign version
run: cosign version
- name: Install Syft
uses: anchore/sbom-action/download-syft@main
- name: Syft version
run: syft version
# GoReleaser will take care of publishing those artifacts into the release
- name: Run GoReleaser
uses: goreleaser/goreleaser-action@v2
@ -109,6 +116,7 @@ jobs:
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
TAG: ${{ steps.vars.outputs.version_tag }}
COSIGN_EXPERIMENTAL: 1
# Only publish on non-special tags (e.g. non-beta)
# We will continue to push to Gemfury for the foreseeable future, although

View File

@ -62,9 +62,18 @@ builds:
goarm: "5"
flags:
- -trimpath
- -mod=readonly
ldflags:
- -s -w
signs:
- cmd: cosign
signature: "${artifact}.sig"
args: ["sign-blob", "--oidc-issuer=https://token.actions.githubusercontent.com", "--output=${signature}", "${artifact}"]
artifacts: all
sboms:
- artifacts: binary
cmd: syft
args: ["$artifact", "--file", "$sbom", "--output", "cyclonedx-json"]
archives:
- format_overrides:
- goos: windows