Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 13, 14:15 UTC
ci: generate SBOM and sign artifacts using cosign (#4910)
* ci: sign artifacts using cosign * include SBOM
Mohammed Al Sahaf committed
Sep 3, 2022 at 03:37 UTC
d6b3c7d2623d9a809abda367fb93dc48b0ba7d7c
2 files changed
+19
-2
.github/workflows/release.yml
+9
-1
@@ -99,7 +99,14 @@ jobs:
99
key: ${{ runner.os }}-go${{ matrix.go }}-release-${{ hashFiles('**/go.sum') }}
100
restore-keys: |
101
${{ runner.os }}-go${{ matrix.go }}-release
102
-
102
+ - name: Install Cosign
103
+ uses: sigstore/cosign-installer@main
104
+ - name: Cosign version
105
+ run: cosign version
106
+ - name: Install Syft
107
+ uses: anchore/sbom-action/download-syft@main
108
+ - name: Syft version
109
+ run: syft version
110
# GoReleaser will take care of publishing those artifacts into the release
111
- name: Run GoReleaser
112
uses: goreleaser/goreleaser-action@v2
@@ -109,6 +116,7 @@ jobs:
116
env:
117
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
118
TAG: ${{ steps.vars.outputs.version_tag }}
119
+ COSIGN_EXPERIMENTAL: 1
120
121
# Only publish on non-special tags (e.g. non-beta)
122
# We will continue to push to Gemfury for the foreseeable future, although
.goreleaser.yml
+10
-1
@@ -62,9 +62,18 @@ builds:
62
goarm: "5"
63
flags:
64
- -trimpath
65
+ - -mod=readonly
66
ldflags:
67
- -s -w
67
-
68
+signs:
69
+ - cmd: cosign
70
+ signature: "${artifact}.sig"
71
+ args: ["sign-blob", "--oidc-issuer=https://token.actions.githubusercontent.com", "--output=${signature}", "${artifact}"]
72
+ artifacts: all
73
+sboms:
74
+ - artifacts: binary
75
+ cmd: syft
76
+ args: ["$artifact", "--file", "$sbom", "--output", "cyclonedx-json"]
77
archives:
78
- format_overrides:
79
- goos: windows