ci: add signed release and provenance workflow #1164
Conversation
blazethunderstorm
requested review from
ashnamehrotra,
jeremyrickard and
sozercan
as code owners
|
@sozercan pls review |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1164 +/- ##
=======================================
Coverage 40.51% 40.51%
=======================================
Files 24 24
Lines 3786 3786
=======================================
Hits 1534 1534
Misses 2140 2140
Partials 112 112 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
.github/workflows/signed-release.yml
Outdated
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Install Cosign | ||
| uses: sigstore/cosign-installer@v3.4.0 |
There was a problem hiding this comment.
please pin to digest for all github actions (see existing actions for examples)
.github/workflows/signed-release.yml
Outdated
| done | ||
|
|
||
| - name: Upload signatures and certs to release | ||
| uses: softprops/action-gh-release@v1 |
There was a problem hiding this comment.
how does this one find the corresponding release
| - name: Upload provenance | ||
| uses: softprops/action-gh-release@v1 | ||
| with: | ||
| files: provenance.intoto.jsonl |
There was a problem hiding this comment.
can you add a validation at the end
|
@sozercan will make all the req changes by today |
blazethunderstorm
force-pushed
the
docy
branch
2 times, most recently
from
238d849 to
773606b
Compare
Signed-off-by: ANIRUDH NARANG <anirudhnarang0@gmail.com>
Signed-off-by: ANIRUDH <anirudhnarang0@gmail.com>
Signed-off-by: Anirudh Narang <anirudhnarang0@gmail.com>
|
@blazethunderstorm are you still working on this feature? |
|
This pull request has been automatically marked as stale because it has not had |
github-project-automation
bot
moved this from 🏗 In progress
to ✅ Done
in Copacetic Workboard
3 participants
Describe the changes in this pull request using active verbs such as Add, Remove, Replace ...
Add workflow to sign release assets and upload provenance for Scorecard compliance.
Closes #1159