Skip to content

Commit 1f4ca28

Browse files
louison77Nicolas-PeifferIceManGreen
authored
Add github action. Add version CLI. Update makefile with LDflags. Merging by hand with meld modifications from lousion77/k8s-kms-plugin-fork (#39)
Signed-off-by: Nicolas-Peiffer <102670102+Nicolas-Peiffer@users.noreply.github.com> Co-authored-by: Nicolas-Peiffer <102670102+Nicolas-Peiffer@users.noreply.github.com> Co-authored-by: Louis Cailliot <108886762+IceManGreen@users.noreply.github.com>
1 parent 8afadb1 commit 1f4ca28

File tree

16 files changed

+1020
-31
lines changed

16 files changed

+1020
-31
lines changed

‎.github/actions/publish-release/action.yaml‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
name: Publish release
2+
3+
description: Publish release, container image, SBOMS, signs artifacts.
4+
5+
inputs:
6+
go-version:
7+
required: true
8+
description: go version to install on the runner
9+
github_token:
10+
required : true
11+
description: github token used for the release
12+
registry_username:
13+
required: true
14+
description: Container registry username
15+
registry_password:
16+
required: true
17+
description: Container registry password
18+
registry:
19+
required: true
20+
description: registry used to publish container images
21+
22+
23+
outputs:
24+
hashes:
25+
value: ${{ steps.binary.outputs.hashes }}
26+
description: hash of the cheksum file in base64
27+
name:
28+
value: ${{ steps.image.outputs.name }}
29+
description: name of the published container image
30+
digest:
31+
value: ${{ steps.image.outputs.digest }}
32+
description: published image digest
33+
34+
runs:
35+
using: composite
36+
steps:
37+
# Install go with specific version
38+
- name: Set up Go
39+
uses: actions/setup-go@v5
40+
with:
41+
go-version: ${{ inputs.go-version }} # same version than the one in the go.mod or in the .go-version
42+
# Register to ghcr.io container Registry
43+
- name: 'Login to GitHub Container Registry'
44+
uses: docker/login-action@v1
45+
with:
46+
registry: ${{ inputs.registry}}
47+
username: ${{ inputs.registry_username }}
48+
password: ${{ inputs.registry_password }}
49+
# Install ko to publish container images
50+
- name: Set up Ko
51+
uses: ko-build/setup-ko@v0.7
52+
# Install cosign to sign artfacts with goreleaser
53+
- name: Install Cosign
54+
uses: sigstore/cosign-installer@v3.5.0
55+
# Get LDFLAGS with a makefile command
56+
- shell: bash
57+
name: Get LDFLAGS
58+
id: get_ldlflags # need to define id to pass the variable to other steps
59+
run : |
60+
echo "ldflags= $(make get-ldflags)" >> "$GITHUB_OUTPUT"
61+
# Install other dependencies like scanners and go librairies
62+
- shell: bash
63+
name : Install dependencies
64+
run : |
65+
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
66+
curl -sSfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.49.1
67+
# Run command goreleaser release based on .goreleaser.yml
68+
# LDFLAGS are passed thanks to the steps.job_id.outputs.variable_name variable
69+
- name: Run GoReleaser
70+
uses: goreleaser/goreleaser-action@v5
71+
id: goreleaser
72+
with:
73+
distribution: goreleaser
74+
version: latest
75+
args: release
76+
env:
77+
GITHUB_TOKEN: ${{ inputs.github_token }}
78+
LDFLAGS: ${{steps.get_ldlflags.outputs.ldflags}}
79+
# Get artifacts from goreleaser's step outputs to generate cheksums file abse64 hashes
80+
# Provenance generator action needs to have a base64 hash for generating blobs provenance
81+
# The hash is passed as an output of goreleaser job
82+
- shell: bash
83+
name: Generate binary hashes
84+
id: binary
85+
env:
86+
ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}"
87+
run: |
88+
set -euo pipefail
89+
checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
90+
echo "hashes=$(cat $checksum_file | base64 -w0)" >> "$GITHUB_OUTPUT"
91+
# Get artifacts from the goreleaser's step outputs to retrieve Docker Manifest containing the image and its digest
92+
# Image Provenance generator action needs to have the image name and a digest for generating provenance and publish it to the container registry
93+
- shell: bash
94+
name: Image digest
95+
id: image
96+
env:
97+
ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}"
98+
run: |
99+
set -euo pipefail
100+
image_and_digest=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Docker Manifest") | .path')
101+
image=$(echo "${image_and_digest}" | cut -d'@' -f1 | cut -d':' -f1)
102+
digest=$(echo "${image_and_digest}" | cut -d'@' -f2)
103+
echo "name=$image" >> "$GITHUB_OUTPUT"
104+
echo "digest=$digest" >> "$GITHUB_OUTPUT"
105+
# Sign image with cosign sign command
106+
- shell: bash
107+
name: Generate Image Signature
108+
env:
109+
#COSIGN_REPOSITORY: ghcr.io/${{github.owner}}/signatures # need to use this variable for having a dfiferent signature repository
110+
IMAGE: ${{ steps.image.outputs.name }}@${{ steps.image.outputs.digest }}
111+
run : |
112+
cosign sign --yes \
113+
${{ env.IMAGE }}

‎.github/actions/verify-attestations/action.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: Verify SLSA attestations
2+
3+
description: Use slsa-verifier to verify provenance attestations
4+
5+
inputs:
6+
go-version:
7+
required: true
8+
description: go version to install on the runner
9+
github_token:
10+
required : true
11+
description: github token used for the release
12+
image:
13+
required: true
14+
description: Image to verify.
15+
tag:
16+
required : false
17+
description : Version of the software.
18+
checksum_file:
19+
required : true
20+
description : Name of the checksum.
21+
22+
23+
runs:
24+
using: composite
25+
steps:
26+
# Install go with specific version
27+
- name: Set up Go
28+
uses: actions/setup-go@v5
29+
with:
30+
go-version: ${{ inputs.go-version }} # same version than the one in the go.mod or in the .go-version
31+
32+
- shell: bash
33+
name : Install dependencies
34+
run : |
35+
go install github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier@v2.5.1
36+
- shell: bash
37+
name: verify image provenance
38+
id: image-provenance
39+
run: |
40+
slsa-verifier verify-image ${{ inputs.image }} \
41+
--source-uri github.com/${{github.repository}} \
42+
--builder-id https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v1.10.0

‎.github/workflows/Goreleaser.yaml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
# .github/workflows/release.yml
2+
name: goreleaser
3+
4+
on:
5+
pull_request:
6+
push:
7+
# run only against tags
8+
tags:
9+
- "*"
10+
11+
jobs:
12+
13+
goreleaser:
14+
runs-on: ubuntu-latest
15+
env:
16+
WORKSPACE: ${{github.workspace}}
17+
# Define job outputs from steps outputs
18+
# It is
19+
outputs:
20+
hashes: ${{ steps.publish-artifacts.outputs.hashes }}
21+
image: ${{ steps.publish-artifacts.outputs.name }}
22+
digest: ${{ steps.publish-artifacts.outputs.digest }}
23+
steps:
24+
- name: Checkout
25+
uses: actions/checkout@v4
26+
with:
27+
fetch-depth: 0
28+
- name: Publish Artifacts
29+
id : publish-artifacts
30+
uses: ./.github/actions/publish-release
31+
with:
32+
go-version: 1.23.0
33+
github_token : ${{ secrets.GITHUB_TOKEN }}
34+
registry: ghcr.io
35+
registry_username: ${{ github.actor }}
36+
registry_password: ${{ secrets.GITHUB_TOKEN }}
37+
38+
# Job generating provenance for blobs artifacts requiring checksum hash in base64 format
39+
# upload-assets is set to true to add in-toto attestation to the release
40+
binary-provenance:
41+
needs: [goreleaser]
42+
permissions:
43+
actions: read # To read the workflow path.
44+
id-token: write # To sign the provenance.
45+
contents: write # To add assets to a release.
46+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0
47+
with:
48+
base64-subjects: "${{ needs.goreleaser.outputs.hashes }}"
49+
upload-assets: true
50+
# Job generating provenance for container images requiring an image and an image digest
51+
image-provenance:
52+
needs: [goreleaser]
53+
permissions:
54+
actions: read
55+
id-token: write
56+
packages: write
57+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.10.0
58+
with:
59+
image: ${{ needs.goreleaser.outputs.image }}
60+
digest: ${{ needs.goreleaser.outputs.digest }}
61+
registry-username: ${{ github.actor }}
62+
secrets:
63+
registry-password: ${{ secrets.GITHUB_TOKEN }}
64+
verify-provenance:
65+
needs: [goreleaser, binary-provenance,image-provenance]
66+
runs-on: ubuntu-latest
67+
env:
68+
WORKSPACE: ${{github.workspace}}
69+
permissions:
70+
actions: read
71+
id-token: write
72+
packages: write
73+
steps:
74+
- name: Checkout
75+
uses: actions/checkout@v4
76+
with:
77+
fetch-depth: 0
78+
- name: Verify provenance attestations
79+
id : slsa-verifier
80+
uses: ./.github/actions/verify-attestations
81+
with:
82+
go-version: 1.23.0
83+
github_token : ${{ secrets.GITHUB_TOKEN }}
84+
image: ${{needs.goreleaser.outputs.image}}@${{needs.goreleaser.outputs.digest}}

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,3 +37,6 @@ vendor/
3737

3838
# Go workspace file
3939
go.work
40+
41+
# output for build
42+
dist/

‎.gitlab-ci.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# .gitlab-ci.yml
2+
variables:
3+
RUNNER_GENERATE_ARTIFACTS_METADATA: "true"
4+
5+
stages:
6+
- release
7+
# Maybe syft is not installed, so it'll need to add another job or action in the script section to install syft on the runner
8+
# https://goreleaser.com/ci/gitlab/#basic-releasing
9+
release:
10+
stage: release
11+
image:
12+
name: goreleaser/goreleaser
13+
entrypoint: [""]
14+
only:
15+
- tags
16+
variables:
17+
18+
GIT_DEPTH: 0
19+
script:
20+
# GITLAB_TOKEN is needed to create GitLab releases.
21+
- make release

0 commit comments

Comments
 (0)