Skip to content

Commit cf425e0

Browse files
wollomaticwollomatic
committed
update Cosign + Cosign-Installer in GH action. Build images for Docker and GHCR separately to avoid useless signatures
1 parent b0f42ff commit cf425e0

2 files changed

Lines changed: 60 additions & 26 deletions

File tree

‎.github/workflows/docker-image-release.yaml‎

Lines changed: 21 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,9 @@ jobs:
2626
run: echo "::set-output name=VERSION::${GITHUB_REF#refs/tags/}"
2727

2828
- name: Install Cosign
29-
uses: sigstore/cosign-installer@v3.8.1
29+
uses: sigstore/cosign-installer@v3.9.2
3030
with:
31-
cosign-release: 'v2.4.3'
31+
cosign-release: 'v2.5.3'
3232

3333
- name: Set up Docker Buildx
3434
uses: docker/setup-buildx-action@v3
@@ -46,9 +46,9 @@ jobs:
4646
username: ${{ github.actor }}
4747
password: ${{ secrets.GITHUB_TOKEN }}
4848

49-
- name: Build and push Docker image
49+
- name: Build and push Docker Hub image
5050
uses: docker/build-push-action@v5
51-
id: build-and-push
51+
id: push-dockerhub
5252
with:
5353
context: .
5454
platforms: linux/amd64,linux/arm/v7,linux/arm64
@@ -57,17 +57,27 @@ jobs:
5757
tags: |
5858
docker.io/wollomatic/socket-proxy:${{ steps.get_tag.outputs.VERSION }}
5959
docker.io/wollomatic/socket-proxy:1
60-
ghcr.io/wollomatic/socket-proxy:${{ steps.get_tag.outputs.VERSION }}
61-
ghcr.io/wollomatic/socket-proxy:1
6260
63-
- name: Sign images for Docker
64-
run: cosign sign --yes --recursive --key env://COSIGN_PRIVATE_KEY docker.io/wollomatic/socket-proxy:${{ steps.get_tag.outputs.VERSION }}@${{ steps.build-and-push.outputs.digest }}
61+
- name: Sign Docker Hub image
62+
run: cosign sign --yes --recursive --key env://COSIGN_PRIVATE_KEY docker.io/wollomatic/socket-proxy:${{ steps.get_tag.outputs.VERSION }}@${{ steps.push-dockerhub.outputs.digest }}
6563
env:
6664
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
6765
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
6866

69-
- name: Sign images for GHCR
70-
run: cosign sign --yes --recursive --key env://COSIGN_PRIVATE_KEY ghcr.io/wollomatic/socket-proxy:${{ steps.get_tag.outputs.VERSION }}@${{ steps.build-and-push.outputs.digest }}
67+
- name: Build and push GHCR image
68+
uses: docker/build-push-action@v5
69+
id: push-ghcr
70+
with:
71+
context: .
72+
platforms: linux/amd64,linux/arm/v7,linux/arm64
73+
push: true
74+
build-args: VERSION=${{ steps.get_tag.outputs.VERSION }}
75+
tags: |
76+
ghcr.io/wollomatic/socket-proxy:${{ steps.get_tag.outputs.VERSION }}
77+
ghcr.io/wollomatic/socket-proxy:1
78+
79+
- name: Sign GHCR image
80+
run: cosign sign --yes --recursive --key env://COSIGN_PRIVATE_KEY ghcr.io/wollomatic/socket-proxy:${{ steps.get_tag.outputs.VERSION }}@${{ steps.push-ghcr.outputs.digest }}
7181
env:
7282
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
73-
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
83+
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}

‎.github/workflows/docker-image-testing.yaml‎

Lines changed: 39 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,10 @@ jobs:
2222
with:
2323
args: ./...
2424

25-
# - name: Install Cosign
26-
# uses: sigstore/cosign-installer@v3.8.1
27-
# with:
28-
# cosign-release: 'v2.4.3'
25+
- name: Install Cosign
26+
uses: sigstore/cosign-installer@v3.9.2
27+
with:
28+
cosign-release: 'v2.5.3'
2929

3030
- name: Set up Docker Buildx
3131
uses: docker/setup-buildx-action@v3
@@ -57,14 +57,38 @@ jobs:
5757
ghcr.io/wollomatic/socket-proxy:testing
5858
ghcr.io/wollomatic/socket-proxy:testing-${{ github.sha }}
5959
60-
# - name: Sign Docker Hub image
61-
# run: cosign sign --yes --recursive --key env://COSIGN_PRIVATE_KEY docker.io/wollomatic/socket-proxy:testing-${{ github.sha }}@${{ steps.build-and-push.outputs.digest }}
62-
# env:
63-
# COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
64-
# COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
65-
#
66-
# - name: Sign GitHub Container Registry image
67-
# run: cosign sign --yes --recursive --key env://COSIGN_PRIVATE_KEY ghcr.io/wollomatic/socket-proxy:testing-${{ github.sha }}@${{ steps.build-and-push.outputs.digest }}
68-
# env:
69-
# COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
70-
# COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
60+
- name: Build and push Docker Hub image
61+
uses: docker/build-push-action@v5
62+
id: push-dockerhub
63+
with:
64+
context: .
65+
platforms: linux/amd64,linux/arm/v7,linux/arm64
66+
push: true
67+
build-args: VERSION=testing-${{ github.sha }}
68+
tags: |
69+
docker.io/wollomatic/socket-proxy:testing
70+
docker.io/wollomatic/socket-proxy:testing-${{ github.sha }}
71+
72+
- name: Sign Docker Hub image
73+
run: cosign sign --yes --recursive --key env://COSIGN_PRIVATE_KEY docker.io/wollomatic/socket-proxy:${{ steps.get_tag.outputs.VERSION }}@${{ steps.push-dockerhub.outputs.digest }}
74+
env:
75+
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
76+
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
77+
78+
- name: Build and push GHCR image
79+
uses: docker/build-push-action@v5
80+
id: push-ghcr
81+
with:
82+
context: .
83+
platforms: linux/amd64,linux/arm/v7,linux/arm64
84+
push: true
85+
build-args: VERSION=testing-${{ github.sha }}
86+
tags: |
87+
ghcr.io/wollomatic/socket-proxy:testing
88+
ghcr.io/wollomatic/socket-proxy:testing-${{ github.sha }}
89+
90+
- name: Sign GHCR image
91+
run: cosign sign --yes --recursive --key env://COSIGN_PRIVATE_KEY ghcr.io/wollomatic/socket-proxy:${{ steps.get_tag.outputs.VERSION }}@${{ steps.push-ghcr.outputs.digest }}
92+
env:
93+
COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
94+
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}

0 commit comments

Comments
 (0)