Skip to content

Commit 8ffb653

Browse files
jotakjotak
committed
Enhance release workflow with SBOM and signing
Added new jobs in release.yml workflow, - cosign-installer - Sign and verify the image with GitHub OIDC Token - Attest Provenance attestations - Generate SBOM - Attest SBOM Co-authored-by: @Helion55
1 parent fb830de commit 8ffb653

1 file changed

Lines changed: 95 additions & 2 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 95 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,21 +5,29 @@ on:
55

66
permissions:
77
contents: write
8+
id-token: write
9+
attestations: write
10+
artifact-metadata: write
811

912
env:
1013
WF_REGISTRY_USER: netobserv+github_ci
1114
WF_ORG: netobserv
1215
WF_MULTIARCH_TARGETS: amd64 arm64 ppc64le s390x
16+
WF_REGISTRY_NAME: quay.io
17+
WF_IMAGE_NAME: quay.io/netobserv/network-observability-console-plugin
18+
WF_STANDALONE_IMAGE_NAME: quay.io/netobserv/network-observability-standalone-frontend
1319

1420
jobs:
1521
push-image:
1622
name: build and push release
1723
runs-on: ubuntu-latest
24+
1825
steps:
1926
- name: checkout
2027
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
2128
with:
2229
persist-credentials: false
30+
2331
- name: validate tag
2432
run: |
2533
tag=`git describe --exact-match --tags 2> /dev/null`
@@ -31,23 +39,108 @@ jobs:
3139
echo "$tag is NOT a valid release tag"
3240
exit 1
3341
fi
42+
3443
- name: install make
3544
run: sudo apt-get install make
45+
3646
- name: docker login to quay.io
3747
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
3848
with:
3949
username: ${{ env.WF_REGISTRY_USER }}
4050
password: ${{ secrets.QUAY_SECRET }}
41-
registry: quay.io
51+
registry: ${{ env.WF_REGISTRY_NAME }}
52+
4253
- name: build and push manifest with images
4354
run: MULTIARCH_TARGETS="${{ env.WF_MULTIARCH_TARGETS }}" IMAGE_ORG=${{ env.WF_ORG }} VERSION=${{ env.tag }} CLEAN_BUILD=1 make images
55+
4456
- name: build and push manifest with images for standalone build
4557
run: |
4658
MULTIARCH_TARGETS="${{ env.WF_MULTIARCH_TARGETS }}" IMAGE_ORG=${{ env.WF_ORG }} VERSION=${{ env.tag }} CLEAN_BUILD=1 STANDALONE=true make images
47-
- name: create draft release
59+
60+
- name: capture image digest
61+
id: image_digest
62+
run: |
63+
mkdir -p release-assets
64+
digest=$(docker buildx imagetools inspect ${{ env.WF_IMAGE_NAME }}:${{ env.tag }} \
65+
--format '{{json .Manifest.Digest}}' | tr -d '"')
66+
echo "digest=$digest" >> "$GITHUB_ENV"
67+
echo "${{ env.WF_IMAGE_NAME }}@${{ digest }}" >> ./release-assets/images
68+
69+
digest_standalone=$(docker buildx imagetools inspect ${{ env.WF_STANDALONE_IMAGE_NAME }}:${{ env.tag }} \
70+
--format '{{json .Manifest.Digest}}' | tr -d '"')
71+
echo "digest_standalone=$digest_standalone" >> "$GITHUB_ENV"
72+
echo "${{ env.WF_STANDALONE_IMAGE_NAME }}@${{ digest_standalone }}" >> ./release-assets/images
73+
74+
- name: cosign-installer
75+
uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003
76+
77+
- name: Sign and verify the image with GitHub OIDC Token
78+
run: |
79+
cosign sign --yes ${{ env.WF_IMAGE_NAME }}@${{ env.digest }}
80+
81+
cosign verify ${{ env.WF_IMAGE_NAME }}@${{ env.digest }} \
82+
--certificate-identity=https://github.com/netobserv/netobserv-web-console/.github/workflows/release.yml@refs/tags/${{ env.tag }} \
83+
--certificate-oidc-issuer=https://token.actions.githubusercontent.com
84+
85+
cosign sign --yes ${{ env.WF_STANDALONE_IMAGE_NAME }}@${{ env.digest_standalone }}
86+
87+
cosign verify ${{ env.WF_STANDALONE_IMAGE_NAME }}@${{ env.digest_standalone }} \
88+
--certificate-identity=https://github.com/netobserv/netobserv-web-console/.github/workflows/release.yml@refs/tags/${{ env.tag }} \
89+
--certificate-oidc-issuer=https://token.actions.githubusercontent.com
90+
91+
- name: Attest Provenance attestations
92+
uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4
93+
with:
94+
subject-name: ${{ env.WF_IMAGE_NAME }}
95+
subject-digest: ${{ env.digest }}
96+
push-to-registry: true
97+
98+
- name: Attest Provenance attestations (standalone)
99+
uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4
100+
with:
101+
subject-name: ${{ env.WF_STANDALONE_IMAGE_NAME }}
102+
subject-digest: ${{ env.digest_standalone }}
103+
push-to-registry: true
104+
105+
- name: Generate SBOM
106+
uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
107+
with:
108+
image: ${{ env.WF_IMAGE_NAME }}@${{ env.digest }}
109+
registry-username: ${{ env.WF_REGISTRY_USER }}
110+
registry-password: ${{ secrets.QUAY_SECRET }}
111+
format: 'spdx-json'
112+
output-file: './release-assets/sbom.spdx.json'
113+
114+
- name: Generate SBOM (standalone)
115+
uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
116+
with:
117+
image: ${{ env.WF_STANDALONE_IMAGE_NAME }}@${{ env.digest_standalone }}
118+
registry-username: ${{ env.WF_REGISTRY_USER }}
119+
registry-password: ${{ secrets.QUAY_SECRET }}
120+
format: 'spdx-json'
121+
output-file: './release-assets/sbom-standalone.spdx.json'
122+
123+
- name: Attest SBOM
124+
uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4
125+
with:
126+
subject-name: ${{ env.WF_IMAGE_NAME }}
127+
subject-digest: ${{ env.digest }}
128+
sbom-path: './release-assets/sbom.spdx.json'
129+
push-to-registry: true
130+
131+
- name: Attest SBOM (standalone)
132+
uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4
133+
with:
134+
subject-name: ${{ env.WF_STANDALONE_IMAGE_NAME }}
135+
subject-digest: ${{ env.digest_standalone }}
136+
sbom-path: './release-assets/sbom-standalone.spdx.json'
137+
push-to-registry: true
138+
139+
- name: create draft release and upload binaries
48140
uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
49141
with:
50142
tag_name: ${{ env.tag }}
51143
name: ${{ env.tag }}
52144
draft: true
53145
prerelease: false
146+
files: ./release-assets/*

0 commit comments

Comments
 (0)