From a4c6f17db37e6a351589f289839747cdade4ba77 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek <> Date: Mon, 4 Dec 2023 14:04:43 +0100 Subject: [PATCH] Replace unpinned actions with pinned action --- .../workflows/docker-image-multiple-tags.yml | 21 ++------- .github/workflows/docker-image-slash.yml | 21 ++------- .github/workflows/docker-image.yml | 21 ++------- .github/workflows/docker-publish-unsigned.yml | 19 ++------ .github/workflows/patched.yml | 20 ++------- .github/workflows/sign-tag.yml | 45 ++++++++----------- 6 files changed, 39 insertions(+), 108 deletions(-) diff --git a/.github/workflows/docker-image-multiple-tags.yml b/.github/workflows/docker-image-multiple-tags.yml index e0f489e..3214265 100644 --- a/.github/workflows/docker-image-multiple-tags.yml +++ b/.github/workflows/docker-image-multiple-tags.yml @@ -1,30 +1,25 @@ name: Docker-multiple-tags - # This workflow uses actions that are not certified by GitHub. # They are provided by a third-party and are governed by # separate terms of service, privacy policy, and support # documentation. - on: workflow_dispatch: schedule: - cron: '15 12 * * *' push: - branches: [ "main" ] + branches: ["main"] # Publish semver tags as releases. - tags: [ 'v*.*.*' ] + tags: ['v*.*.*'] pull_request: - branches: [ "main" ] - + branches: ["main"] env: # Use docker.io for Docker Hub if empty REGISTRY: ghcr.io # github.repository as / IMAGE_NAME: ${{ github.repository }} - jobs: build: - runs-on: ubuntu-latest permissions: contents: read @@ -32,11 +27,9 @@ jobs: # This is used to complete the identity challenge # with sigstore/fulcio when running outside of PRs. id-token: write - steps: - name: Checkout repository - uses: actions/checkout@v3 - + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 # Install the cosign tool except on PR # https://github.com/sigstore/cosign-installer - name: Install cosign @@ -44,11 +37,9 @@ jobs: uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1 with: cosign-release: 'v2.1.1' - # Workaround: https://github.com/docker/build-push-action/issues/461 - name: Setup Docker buildx uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf - # Login against a Docker registry except on PR # https://github.com/docker/login-action - name: Log into registry ${{ env.REGISTRY }} @@ -58,7 +49,6 @@ jobs: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - # Extract metadata (tags, labels) for Docker # https://github.com/docker/metadata-action - name: Extract Docker metadata @@ -66,7 +56,6 @@ jobs: uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - # Build and push Docker image with Buildx (don't push on PR) # https://github.com/docker/build-push-action - name: Build and push Docker image @@ -79,8 +68,6 @@ jobs: labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max - - # Sign the resulting Docker image digest except on PRs. # This will only write to the public Rekor transparency log when the Docker # repository is public to avoid leaking data. If you would like to publish diff --git a/.github/workflows/docker-image-slash.yml b/.github/workflows/docker-image-slash.yml index b6ffdb7..e7d09c4 100644 --- a/.github/workflows/docker-image-slash.yml +++ b/.github/workflows/docker-image-slash.yml @@ -1,30 +1,25 @@ name: Docker-slash - # This workflow uses actions that are not certified by GitHub. # They are provided by a third-party and are governed by # separate terms of service, privacy policy, and support # documentation. - on: workflow_dispatch: schedule: - cron: '15 12 * * *' push: - branches: [ "main" ] + branches: ["main"] # Publish semver tags as releases. - tags: [ 'v*.*.*' ] + tags: ['v*.*.*'] pull_request: - branches: [ "main" ] - + branches: ["main"] env: # Use docker.io for Docker Hub if empty REGISTRY: ghcr.io # github.repository as / IMAGE_NAME: ${{ github.repository }}/somepart - jobs: build: - runs-on: ubuntu-latest permissions: contents: read @@ -32,11 +27,9 @@ jobs: # This is used to complete the identity challenge # with sigstore/fulcio when running outside of PRs. id-token: write - steps: - name: Checkout repository - uses: actions/checkout@v3 - + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 # Install the cosign tool except on PR # https://github.com/sigstore/cosign-installer - name: Install cosign @@ -44,11 +37,9 @@ jobs: uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1 with: cosign-release: 'v2.1.1' - # Workaround: https://github.com/docker/build-push-action/issues/461 - name: Setup Docker buildx uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf - # Login against a Docker registry except on PR # https://github.com/docker/login-action - name: Log into registry ${{ env.REGISTRY }} @@ -58,7 +49,6 @@ jobs: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - # Extract metadata (tags, labels) for Docker # https://github.com/docker/metadata-action - name: Extract Docker metadata @@ -66,7 +56,6 @@ jobs: uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - # Build and push Docker image with Buildx (don't push on PR) # https://github.com/docker/build-push-action - name: Build and push Docker image @@ -79,8 +68,6 @@ jobs: labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max - - # Sign the resulting Docker image digest except on PRs. # This will only write to the public Rekor transparency log when the Docker # repository is public to avoid leaking data. If you would like to publish diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml index b329bb8..20f89bb 100644 --- a/.github/workflows/docker-image.yml +++ b/.github/workflows/docker-image.yml @@ -1,30 +1,25 @@ name: Docker - # This workflow uses actions that are not certified by GitHub. # They are provided by a third-party and are governed by # separate terms of service, privacy policy, and support # documentation. - on: workflow_dispatch: schedule: - cron: '15 12 * * *' push: - branches: [ "main" ] + branches: ["main"] # Publish semver tags as releases. - tags: [ 'v*.*.*' ] + tags: ['v*.*.*'] pull_request: - branches: [ "main" ] - + branches: ["main"] env: # Use docker.io for Docker Hub if empty REGISTRY: ghcr.io # github.repository as / IMAGE_NAME: ${{ github.repository }} - jobs: build: - runs-on: ubuntu-latest permissions: contents: read @@ -32,11 +27,9 @@ jobs: # This is used to complete the identity challenge # with sigstore/fulcio when running outside of PRs. id-token: write - steps: - name: Checkout repository - uses: actions/checkout@v3 - + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 # Install the cosign tool except on PR # https://github.com/sigstore/cosign-installer - name: Install cosign @@ -44,11 +37,9 @@ jobs: uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1 with: cosign-release: 'v2.1.1' - # Workaround: https://github.com/docker/build-push-action/issues/461 - name: Setup Docker buildx uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf - # Login against a Docker registry except on PR # https://github.com/docker/login-action - name: Log into registry ${{ env.REGISTRY }} @@ -58,7 +49,6 @@ jobs: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - # Extract metadata (tags, labels) for Docker # https://github.com/docker/metadata-action - name: Extract Docker metadata @@ -66,7 +56,6 @@ jobs: uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - # Build and push Docker image with Buildx (don't push on PR) # https://github.com/docker/build-push-action - name: Build and push Docker image @@ -79,8 +68,6 @@ jobs: labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max - - # Sign the resulting Docker image digest except on PRs. # This will only write to the public Rekor transparency log when the Docker # repository is public to avoid leaking data. If you would like to publish diff --git a/.github/workflows/docker-publish-unsigned.yml b/.github/workflows/docker-publish-unsigned.yml index 2a59f33..0d9a9c7 100644 --- a/.github/workflows/docker-publish-unsigned.yml +++ b/.github/workflows/docker-publish-unsigned.yml @@ -1,30 +1,25 @@ name: Docker unsigned - # This workflow uses actions that are not certified by GitHub. # They are provided by a third-party and are governed by # separate terms of service, privacy policy, and support # documentation. - on: workflow_dispatch: schedule: - cron: '15 12 * * *' push: - branches: [ "main" ] + branches: ["main"] # Publish semver tags as releases. - tags: [ 'v*.*.*' ] + tags: ['v*.*.*'] pull_request: - branches: [ "main" ] - + branches: ["main"] env: # Use docker.io for Docker Hub if empty REGISTRY: ghcr.io # github.repository as / IMAGE_NAME: ${{ github.repository }} - jobs: build: - runs-on: ubuntu-latest permissions: contents: read @@ -32,11 +27,9 @@ jobs: # This is used to complete the identity challenge # with sigstore/fulcio when running outside of PRs. id-token: write - steps: - name: Checkout repository - uses: actions/checkout@v3 - + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 # Install the cosign tool except on PR # https://github.com/sigstore/cosign-installer - name: Install cosign @@ -44,11 +37,9 @@ jobs: uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1 with: cosign-release: 'v2.1.1' - # Workaround: https://github.com/docker/build-push-action/issues/461 - name: Setup Docker buildx uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf - # Login against a Docker registry except on PR # https://github.com/docker/login-action - name: Log into registry ${{ env.REGISTRY }} @@ -58,7 +49,6 @@ jobs: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - # Extract metadata (tags, labels) for Docker # https://github.com/docker/metadata-action - name: Extract Docker metadata @@ -66,7 +56,6 @@ jobs: uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - # Build and push Docker image with Buildx (don't push on PR) # https://github.com/docker/build-push-action - name: Build and push Docker image diff --git a/.github/workflows/patched.yml b/.github/workflows/patched.yml index 34e32a8..615b0e4 100644 --- a/.github/workflows/patched.yml +++ b/.github/workflows/patched.yml @@ -1,28 +1,23 @@ name: Docker unsigned - patched - # This workflow uses actions that are not certified by GitHub. # They are provided by a third-party and are governed by # separate terms of service, privacy policy, and support # documentation. - on: workflow_dispatch: push: - branches: [ "main" ] + branches: ["main"] # Publish semver tags as releases. - tags: [ 'v*.*.*' ] + tags: ['v*.*.*'] pull_request: - branches: [ "main" ] - + branches: ["main"] env: # Use docker.io for Docker Hub if empty REGISTRY: ghcr.io # github.repository as / IMAGE_NAME: ${{ github.repository }} - jobs: build: - runs-on: ubuntu-latest permissions: contents: read @@ -30,11 +25,9 @@ jobs: # This is used to complete the identity challenge # with sigstore/fulcio when running outside of PRs. id-token: write - steps: - name: Checkout repository - uses: actions/checkout@v3 - + uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 # Install the cosign tool except on PR # https://github.com/sigstore/cosign-installer - name: Install cosign @@ -42,11 +35,9 @@ jobs: uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1 with: cosign-release: 'v2.1.1' - # Workaround: https://github.com/docker/build-push-action/issues/461 - name: Setup Docker buildx uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf - # Login against a Docker registry except on PR # https://github.com/docker/login-action - name: Log into registry ${{ env.REGISTRY }} @@ -56,7 +47,6 @@ jobs: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - # Extract metadata (tags, labels) for Docker # https://github.com/docker/metadata-action - name: Extract Docker metadata @@ -64,7 +54,6 @@ jobs: uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - # Build and push Docker image with Buildx (don't push on PR) # https://github.com/docker/build-push-action - name: Build and push Docker image @@ -78,7 +67,6 @@ jobs: cache-from: type=gha cache-to: type=gha,mode=max platforms: linux/amd64,linux/arm64 - # Sign the resulting Docker image digest except on PRs. # This will only write to the public Rekor transparency log when the Docker # repository is public to avoid leaking data. If you would like to publish diff --git a/.github/workflows/sign-tag.yml b/.github/workflows/sign-tag.yml index 87cc1d1..dd8b669 100644 --- a/.github/workflows/sign-tag.yml +++ b/.github/workflows/sign-tag.yml @@ -1,38 +1,31 @@ name: Sign Git Tag with Gitsign - on: push: tags: - '*' - jobs: sign-tag: runs-on: ubuntu-latest permissions: id-token: write contents: read - steps: - - name: Checkout code - uses: actions/checkout@v2 - - - name: Get the tag name - id: tag_name - run: echo "TAG_NAME=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV - - - name: Debug, remove me later - run: echo "The tag is ${{ env.TAG_NAME }}" - - - name: Install gitsign - run: | - curl -Lo gitsign https://github.com/sigstore/gitsign/releases/download/v0.8.0/gitsign_0.8.0_linux_arm64 - chmod +x gitsign - sudo mv gitsign /usr/local/bin/ - - - name: Configure gitsign - run: | - # https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key#telling-git-about-your-x509-key - git config --global gpg.x509.program gitsign - git config --global gpg.format x509 - # FIXME: should this be an annotated tag, e.g. tag.forceSignAnnotated ? - git config --global tag.gpgSign + - name: Checkout code + uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2 + - name: Get the tag name + id: tag_name + run: echo "TAG_NAME=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV + - name: Debug, remove me later + run: echo "The tag is ${{ env.TAG_NAME }}" + - name: Install gitsign + run: | + curl -Lo gitsign https://github.com/sigstore/gitsign/releases/download/v0.8.0/gitsign_0.8.0_linux_arm64 + chmod +x gitsign + sudo mv gitsign /usr/local/bin/ + - name: Configure gitsign + run: | + # https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key#telling-git-about-your-x509-key + git config --global gpg.x509.program gitsign + git config --global gpg.format x509 + # FIXME: should this be an annotated tag, e.g. tag.forceSignAnnotated ? + git config --global tag.gpgSign