From 90e8b5e95043299f60edecae159ab4c2de614cde Mon Sep 17 00:00:00 2001 From: Stefan Prodan Date: Tue, 16 Sep 2025 14:00:52 +0300 Subject: [PATCH 1/9] ci: Add `sync-labels` workflow Signed-off-by: Stefan Prodan --- .github/workflows/labels-sync.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .github/workflows/labels-sync.yaml diff --git a/.github/workflows/labels-sync.yaml b/.github/workflows/labels-sync.yaml new file mode 100644 index 0000000..db2402c --- /dev/null +++ b/.github/workflows/labels-sync.yaml @@ -0,0 +1,14 @@ +name: sync-labels +on: + workflow_dispatch: + push: + branches: + - main + paths: + - .github/labels.yaml +jobs: + sync-labels: + permissions: + issues: write + contents: read + uses: fluxcd/gha-workflows/.github/workflows/labels-sync.yaml@v0.0.1 From e6e0e831e69edb36a71412ebaf7e6e6601f995b4 Mon Sep 17 00:00:00 2001 From: Stefan Prodan Date: Tue, 16 Sep 2025 14:01:33 +0300 Subject: [PATCH 2/9] Add `backport:release/v2.0.x` label Signed-off-by: Stefan Prodan --- .github/dependabot.yaml | 3 +++ .github/labels.yaml | 13 +++++++++++++ 2 files changed, 16 insertions(+) create mode 100644 .github/labels.yaml diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml index 50e984e..62f13db 100644 --- a/.github/dependabot.yaml +++ b/.github/dependabot.yaml @@ -2,6 +2,7 @@ version: 2 updates: - package-ecosystem: "gomod" + labels: ["dependencies"] directory: "/" schedule: interval: "monthly" @@ -20,6 +21,7 @@ updates: - dependency-name: "k8s.io/*" - dependency-name: "sigs.k8s.io/*" - package-ecosystem: "github-actions" + labels: ["dependencies"] directory: "/" schedule: interval: "monthly" @@ -28,6 +30,7 @@ updates: patterns: - "*" - package-ecosystem: "docker" + labels: ["dependencies"] directory: "/" schedule: interval: "monthly" diff --git a/.github/labels.yaml b/.github/labels.yaml new file mode 100644 index 0000000..31b78d8 --- /dev/null +++ b/.github/labels.yaml @@ -0,0 +1,13 @@ +# Configuration file to declaratively configure labels +# Ref: https://github.com/EndBug/label-sync#Config-files + +- name: area/generator + description: Artifact generation related issues and pull requests + color: '#00b140' +- name: area/storage + description: Artifact storage related issues and pull requests + color: '#4b0082' +- name: backport:release/v2.0.x + description: To be backported to release/v2.0.x + color: '#ffd700' + From 97bf74cde8c4e58eb0492d0c06b44df0b33a679f Mon Sep 17 00:00:00 2001 From: Stefan Prodan Date: Tue, 16 Sep 2025 14:37:01 +0300 Subject: [PATCH 3/9] ci: Add `backport` workflow Signed-off-by: Stefan Prodan --- .github/workflows/backport.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 .github/workflows/backport.yaml diff --git a/.github/workflows/backport.yaml b/.github/workflows/backport.yaml new file mode 100644 index 0000000..0823c9f --- /dev/null +++ b/.github/workflows/backport.yaml @@ -0,0 +1,10 @@ +name: backport +on: + pull_request_target: + types: [closed, labeled] +jobs: + backport: + permissions: + contents: write + pull-requests: write + uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.0.2 From 8f15971aa02718e3b14efab89476d94c9c243bcb Mon Sep 17 00:00:00 2001 From: Stefan Prodan Date: Tue, 16 Sep 2025 14:53:23 +0300 Subject: [PATCH 4/9] ci: Set token in `backport` workflow Signed-off-by: Stefan Prodan --- .github/workflows/backport.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/backport.yaml b/.github/workflows/backport.yaml index 0823c9f..434f3ff 100644 --- a/.github/workflows/backport.yaml +++ b/.github/workflows/backport.yaml @@ -8,3 +8,5 @@ jobs: contents: write pull-requests: write uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.0.2 + secrets: + github-token: ${{ secrets.BOT_GITHUB_TOKEN }} From 15e20e1eb27cf6697d0ffa595aaad9c7e7110157 Mon Sep 17 00:00:00 2001 From: Stefan Prodan Date: Tue, 16 Sep 2025 15:33:27 +0300 Subject: [PATCH 5/9] ci: Use `GITHUB_TOKEN` in the backport workflow Signed-off-by: Stefan Prodan --- .github/workflows/backport.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/backport.yaml b/.github/workflows/backport.yaml index 434f3ff..a94bf5e 100644 --- a/.github/workflows/backport.yaml +++ b/.github/workflows/backport.yaml @@ -7,6 +7,6 @@ jobs: permissions: contents: write pull-requests: write - uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.0.2 + uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.0.3 secrets: - github-token: ${{ secrets.BOT_GITHUB_TOKEN }} + github-token: ${{ secrets.GITHUB_TOKEN }} From 8b49ddf09777e471acededb523f986071c251a79 Mon Sep 17 00:00:00 2001 From: Stefan Prodan Date: Tue, 16 Sep 2025 16:09:02 +0300 Subject: [PATCH 6/9] ci: Add `code-scan` workflow Signed-off-by: Stefan Prodan --- .github/workflows/backport.yaml | 2 +- .github/workflows/code-scan.yaml | 15 +++++++++++++++ .github/workflows/labels-sync.yaml | 2 +- README.md | 1 + 4 files changed, 18 insertions(+), 2 deletions(-) create mode 100644 .github/workflows/code-scan.yaml diff --git a/.github/workflows/backport.yaml b/.github/workflows/backport.yaml index a94bf5e..c17597d 100644 --- a/.github/workflows/backport.yaml +++ b/.github/workflows/backport.yaml @@ -7,6 +7,6 @@ jobs: permissions: contents: write pull-requests: write - uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.0.3 + uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.0.4 secrets: github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/code-scan.yaml b/.github/workflows/code-scan.yaml new file mode 100644 index 0000000..06dbe38 --- /dev/null +++ b/.github/workflows/code-scan.yaml @@ -0,0 +1,15 @@ +name: code-scan +on: + push: + branches: [ main ] + pull_request: + branches: [ main ] +jobs: + analyze: + permissions: + contents: read + security-events: write + uses: fluxcd/gha-workflows/.github/workflows/code-scan.yaml@v0.0.4 + secrets: + github-token: ${{ secrets.GITHUB_TOKEN }} + fossa-token: ${{ secrets.FOSSA_TOKEN }} diff --git a/.github/workflows/labels-sync.yaml b/.github/workflows/labels-sync.yaml index db2402c..ecb0bb3 100644 --- a/.github/workflows/labels-sync.yaml +++ b/.github/workflows/labels-sync.yaml @@ -11,4 +11,4 @@ jobs: permissions: issues: write contents: read - uses: fluxcd/gha-workflows/.github/workflows/labels-sync.yaml@v0.0.1 + uses: fluxcd/gha-workflows/.github/workflows/labels-sync.yaml@v0.0.4 diff --git a/README.md b/README.md index f011295..bcb19bb 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,6 @@ # source-watcher +[![fossa](https://app.fossa.com/api/projects/custom%2B162%2Fgithub.com%2Ffluxcd%2Fsource-watcher.svg?type=small)](https://app.fossa.com/projects/custom%2B162%2Fgithub.com%2Ffluxcd%2Fsource-watcher?ref=badge_small) [![test](https://github.com/fluxcd/source-watcher/workflows/e2e/badge.svg)](https://github.com/fluxcd/source-watcher/actions) [![report](https://goreportcard.com/badge/github.com/fluxcd/source-watcher)](https://goreportcard.com/report/github.com/fluxcd/source-watcher) [![license](https://img.shields.io/github/license/fluxcd/source-watcher.svg)](https://github.com/fluxcd/source-watcher/blob/main/LICENSE) From 61c3400da71a1db5a63d6eda7f338768e43b04ce Mon Sep 17 00:00:00 2001 From: Stefan Prodan Date: Mon, 22 Sep 2025 12:54:59 +0300 Subject: [PATCH 7/9] ci: Refactor CI with `fluxcd/gha-workflows` Signed-off-by: Stefan Prodan --- .github/workflows/backport.yaml | 6 +- .github/workflows/code-scan.yaml | 6 +- .github/workflows/e2e.yaml | 25 +----- .github/workflows/labels-sync.yaml | 8 +- .github/workflows/release.yaml | 125 +++-------------------------- 5 files changed, 28 insertions(+), 142 deletions(-) diff --git a/.github/workflows/backport.yaml b/.github/workflows/backport.yaml index c17597d..108e3e2 100644 --- a/.github/workflows/backport.yaml +++ b/.github/workflows/backport.yaml @@ -5,8 +5,8 @@ on: jobs: backport: permissions: - contents: write - pull-requests: write - uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.0.4 + contents: write # for reading and creating branches. + pull-requests: write # for creating pull requests against release branches. + uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.3.0 secrets: github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/code-scan.yaml b/.github/workflows/code-scan.yaml index 06dbe38..06fd9b4 100644 --- a/.github/workflows/code-scan.yaml +++ b/.github/workflows/code-scan.yaml @@ -7,9 +7,9 @@ on: jobs: analyze: permissions: - contents: read - security-events: write - uses: fluxcd/gha-workflows/.github/workflows/code-scan.yaml@v0.0.4 + contents: read # for reading the repository code. + security-events: write # for uploading the CodeQL analysis results. + uses: fluxcd/gha-workflows/.github/workflows/code-scan.yaml@v0.3.0 secrets: github-token: ${{ secrets.GITHUB_TOKEN }} fossa-token: ${{ secrets.FOSSA_TOKEN }} diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index 8a5cab7..819bc30 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -1,36 +1,19 @@ name: e2e - on: pull_request: push: branches: - main - jobs: kind: runs-on: ubuntu-latest + permissions: + contents: read # for reading the repository code. steps: - - name: Checkout - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - - name: Setup QEMU - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 - - name: Setup Docker Buildx - id: buildx - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 - - name: Setup Go - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0 + - name: Test suite setup + uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.3.0 with: go-version: 1.25.x - cache-dependency-path: | - **/go.sum - **/go.mod - - name: Setup Kubernetes - uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0 - with: - version: v0.30.0 - cluster_name: kind - - name: Setup Kustomize - uses: fluxcd/pkg/actions/kustomize@main - name: Run tests run: make test - name: Check if working tree is dirty diff --git a/.github/workflows/labels-sync.yaml b/.github/workflows/labels-sync.yaml index ecb0bb3..cc69156 100644 --- a/.github/workflows/labels-sync.yaml +++ b/.github/workflows/labels-sync.yaml @@ -9,6 +9,8 @@ on: jobs: sync-labels: permissions: - issues: write - contents: read - uses: fluxcd/gha-workflows/.github/workflows/labels-sync.yaml@v0.0.4 + contents: read # for reading the labels file. + issues: write # for creating and updating labels. + uses: fluxcd/gha-workflows/.github/workflows/labels-sync.yaml@v0.3.0 + secrets: + github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 79ad03f..3314551 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -1,5 +1,4 @@ name: release - on: push: tags: @@ -10,117 +9,19 @@ on: description: 'image tag prefix' default: 'rc' required: true - -permissions: - contents: read - -env: - CONTROLLER: ${{ github.event.repository.name }} - jobs: release: - outputs: - hashes: ${{ steps.hash.outputs.hashes }} - image_url: ${{ steps.hash.outputs.image_url }} - image_digest: ${{ steps.hash.outputs.image_digest }} - runs-on: ubuntu-latest permissions: - contents: write # needed to write releases - id-token: write # needed for keyless signing - packages: write # needed for ghcr access - steps: - - name: Checkout - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - - name: Setup Kustomize - uses: fluxcd/pkg/actions/kustomize@main - - name: Prepare - id: prep - run: | - VERSION="${{ github.event.inputs.tag }}-${GITHUB_SHA::8}" - if [[ $GITHUB_REF == refs/tags/* ]]; then - VERSION=${GITHUB_REF/refs\/tags\//} - fi - echo "version=${VERSION}" >> $GITHUB_OUTPUT - - name: Setup Go - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0 - with: - go-version: 1.25.x - cache-dependency-path: | - **/go.sum - **/go.mod - - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 - - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 - - uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2 - - uses: anchore/sbom-action/download-syft@da167eac915b4e86f08b264dbdbc867b61be6f0c # v0.20.5 - - name: Docker login ghcr.io - uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0 - with: - registry: ghcr.io - username: fluxcdbot - password: ${{ secrets.GHCR_TOKEN }} - - name: Docker login docker.io - uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0 - with: - username: fluxcdbot - password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }} - - name: Docker meta - id: meta - uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0 - with: - images: | - fluxcd/${{ env.CONTROLLER }} - ghcr.io/fluxcd/${{ env.CONTROLLER }} - tags: | - type=raw,value=${{ steps.prep.outputs.version }} - - name: Docker push - uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 - id: build-push - with: - sbom: true - provenance: true - push: true - builder: ${{ steps.buildx.outputs.name }} - context: . - file: ./Dockerfile - platforms: linux/amd64,linux/arm/v7,linux/arm64 - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - - name: Sign images - env: - COSIGN_EXPERIMENTAL: 1 - run: | - cosign sign --yes fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.version }} - cosign sign --yes ghcr.io/fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.version }} - - name: Generate release artifacts - if: startsWith(github.ref, 'refs/tags/v') - run: | - mkdir -p config/release - kustomize build ./config/crd > ./config/release/${{ env.CONTROLLER }}.crds.yaml - kustomize build ./config/manager > ./config/release/${{ env.CONTROLLER }}.deployment.yaml - - name: GoReleaser publish signed SBOM - id: run-goreleaser - if: startsWith(github.ref, 'refs/tags/v') - uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0 - with: - version: latest - args: release --clean --skip=validate - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - name: Generate SLSA hashes - id: hash - env: - ARTIFACTS: "${{ steps.run-goreleaser.outputs.artifacts }}" - run: | - set -euo pipefail - - hashes=$(echo $ARTIFACTS | jq --raw-output '.[] | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {digest} + {name} | join(" ") | sub("^sha256:";"")' | base64 -w0) - echo "hashes=$hashes" >> $GITHUB_OUTPUT - - image_url=fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.version }} - image_digest=${{ steps.build-push.outputs.digest }} - echo "image_url=$image_url" >> $GITHUB_OUTPUT - echo "image_digest=$image_digest" >> $GITHUB_OUTPUT - + contents: write # for creating the GitHub release. + id-token: write # for creating OIDC tokens for signing. + packages: write # for pushing and signing container images. + uses: fluxcd/gha-workflows/.github/workflows/controller-release.yaml@v0.3.0 + with: + controller: ${{ github.event.repository.name }} + release-candidate-prefix: ${{ github.event.inputs.tag }} + secrets: + github-token: ${{ secrets.GITHUB_TOKEN }} + dockerhub-token: ${{ secrets.DOCKER_FLUXCD_PASSWORD }} release-provenance: needs: [release] permissions: @@ -132,10 +33,10 @@ jobs: provenance-name: "provenance.intoto.jsonl" base64-subjects: "${{ needs.release.outputs.hashes }}" upload-assets: true - dockerhub-provenance: needs: [release] permissions: + contents: read # for reading the repository code. actions: read # for detecting the Github Actions environment. id-token: write # for creating OIDC tokens for signing. packages: write # for uploading attestations. @@ -146,10 +47,10 @@ jobs: registry-username: fluxcdbot secrets: registry-password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }} - ghcr-provenance: needs: [release] permissions: + contents: read # for reading the repository code. actions: read # for detecting the Github Actions environment. id-token: write # for creating OIDC tokens for signing. packages: write # for uploading attestations. @@ -159,4 +60,4 @@ jobs: digest: ${{ needs.release.outputs.image_digest }} registry-username: fluxcdbot secrets: - registry-password: ${{ secrets.GHCR_TOKEN }} \ No newline at end of file + registry-password: ${{ secrets.GHCR_TOKEN }} From 094a3a164b1fb18796a5c2fa79cde77cdd502044 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 24 Sep 2025 10:33:34 +0000 Subject: [PATCH 8/9] Bump fluxcd/gha-workflows from 0.3.0 to 0.4.0 in the ci group Bumps the ci group with 1 update: [fluxcd/gha-workflows](https://github.com/fluxcd/gha-workflows). Updates `fluxcd/gha-workflows` from 0.3.0 to 0.4.0 - [Release notes](https://github.com/fluxcd/gha-workflows/releases) - [Commits](https://github.com/fluxcd/gha-workflows/compare/v0.3.0...v0.4.0) --- updated-dependencies: - dependency-name: fluxcd/gha-workflows dependency-version: 0.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci ... Signed-off-by: dependabot[bot] --- .github/workflows/backport.yaml | 2 +- .github/workflows/code-scan.yaml | 2 +- .github/workflows/e2e.yaml | 2 +- .github/workflows/labels-sync.yaml | 2 +- .github/workflows/release.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/backport.yaml b/.github/workflows/backport.yaml index 108e3e2..4081bb1 100644 --- a/.github/workflows/backport.yaml +++ b/.github/workflows/backport.yaml @@ -7,6 +7,6 @@ jobs: permissions: contents: write # for reading and creating branches. pull-requests: write # for creating pull requests against release branches. - uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.3.0 + uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.4.0 secrets: github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/code-scan.yaml b/.github/workflows/code-scan.yaml index 06fd9b4..67cb6dc 100644 --- a/.github/workflows/code-scan.yaml +++ b/.github/workflows/code-scan.yaml @@ -9,7 +9,7 @@ jobs: permissions: contents: read # for reading the repository code. security-events: write # for uploading the CodeQL analysis results. - uses: fluxcd/gha-workflows/.github/workflows/code-scan.yaml@v0.3.0 + uses: fluxcd/gha-workflows/.github/workflows/code-scan.yaml@v0.4.0 secrets: github-token: ${{ secrets.GITHUB_TOKEN }} fossa-token: ${{ secrets.FOSSA_TOKEN }} diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index 819bc30..b043fd1 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -11,7 +11,7 @@ jobs: contents: read # for reading the repository code. steps: - name: Test suite setup - uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.3.0 + uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.4.0 with: go-version: 1.25.x - name: Run tests diff --git a/.github/workflows/labels-sync.yaml b/.github/workflows/labels-sync.yaml index cc69156..a463509 100644 --- a/.github/workflows/labels-sync.yaml +++ b/.github/workflows/labels-sync.yaml @@ -11,6 +11,6 @@ jobs: permissions: contents: read # for reading the labels file. issues: write # for creating and updating labels. - uses: fluxcd/gha-workflows/.github/workflows/labels-sync.yaml@v0.3.0 + uses: fluxcd/gha-workflows/.github/workflows/labels-sync.yaml@v0.4.0 secrets: github-token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 3314551..848306e 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -15,7 +15,7 @@ jobs: contents: write # for creating the GitHub release. id-token: write # for creating OIDC tokens for signing. packages: write # for pushing and signing container images. - uses: fluxcd/gha-workflows/.github/workflows/controller-release.yaml@v0.3.0 + uses: fluxcd/gha-workflows/.github/workflows/controller-release.yaml@v0.4.0 with: controller: ${{ github.event.repository.name }} release-candidate-prefix: ${{ github.event.inputs.tag }} From 521ba8bd2c32017ea30421b0638af2fc8fa511ce Mon Sep 17 00:00:00 2001 From: Matheus Pimenta Date: Wed, 24 Sep 2025 17:20:23 +0100 Subject: [PATCH 9/9] Fix release workflow Signed-off-by: Matheus Pimenta --- .github/workflows/release.yaml | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 848306e..9cc8d6e 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -25,13 +25,14 @@ jobs: release-provenance: needs: [release] permissions: - actions: read # To read the workflow path. - id-token: write # To sign the provenance. - contents: write # To add assets to the release. + actions: read # for detecting the Github Actions environment. + id-token: write # for creating OIDC tokens for signing. + contents: write # for uploading attestations to GitHub releases. + if: startsWith(github.ref, 'refs/tags/v') uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0 with: provenance-name: "provenance.intoto.jsonl" - base64-subjects: "${{ needs.release.outputs.hashes }}" + base64-subjects: "${{ needs.release.outputs.release-digests }}" upload-assets: true dockerhub-provenance: needs: [release] @@ -40,11 +41,12 @@ jobs: actions: read # for detecting the Github Actions environment. id-token: write # for creating OIDC tokens for signing. packages: write # for uploading attestations. + if: startsWith(github.ref, 'refs/tags/v') uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0 with: - image: ${{ needs.release.outputs.image_url }} - digest: ${{ needs.release.outputs.image_digest }} - registry-username: fluxcdbot + image: ${{ needs.release.outputs.image-name }} + digest: ${{ needs.release.outputs.image-digest }} + registry-username: ${{ github.repository_owner == 'fluxcd' && 'fluxcdbot' || github.repository_owner }} secrets: registry-password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }} ghcr-provenance: @@ -54,10 +56,11 @@ jobs: actions: read # for detecting the Github Actions environment. id-token: write # for creating OIDC tokens for signing. packages: write # for uploading attestations. + if: startsWith(github.ref, 'refs/tags/v') uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0 with: - image: ghcr.io/${{ needs.release.outputs.image_url }} - digest: ${{ needs.release.outputs.image_digest }} - registry-username: fluxcdbot + image: ghcr.io/${{ needs.release.outputs.image-name }} + digest: ${{ needs.release.outputs.image-digest }} + registry-username: fluxcdbot # not necessary for ghcr.io secrets: - registry-password: ${{ secrets.GHCR_TOKEN }} + registry-password: ${{ secrets.GITHUB_TOKEN }}