Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 13, 14:15 UTC
ci: add `id-token` permission and update the signing command (#5016)
Mohammed Al Sahaf committed
Sep 5, 2022 at 23:57 UTC
0499d9c1c4177503c4a3d8d6bffd5d44e5edd430
2 files changed
+7
-1
.github/workflows/release.yml
+6
@@ -20,6 +20,12 @@ jobs:
20
GO_SEMVER: '~1.19.0'
21
22
runs-on: ${{ matrix.os }}
23
+ # https://github.com/sigstore/cosign/issues/1258#issuecomment-1002251233
24
+ # https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings
25
+ permissions:
26
+ id-token: write
27
+ # https://docs.github.com/en/rest/overview/permissions-required-for-github-apps#permission-on-contents
28
+ contents: read
29
30
steps:
31
- name: Install Go
.goreleaser.yml
+1
-1
@@ -68,7 +68,7 @@ builds:
68
signs:
69
- cmd: cosign
70
signature: "${artifact}.sig"
71
- args: ["sign-blob", "--oidc-issuer=https://token.actions.githubusercontent.com", "--output=${signature}", "${artifact}"]
71
+ args: ["sign-blob", "--output-signature=${signature}", "--output-certificate", "${signature}.pem", "${artifact}"]
72
artifacts: all
73
sboms:
74
- artifacts: binary