Merge pull request #76 from developer-guy/feature/71

feat: sign with keyless approach
gythialy · Jan 18, 2022 · 0dc6721 · 0dc6721
2 parents ffabe01 + ac2d0b4
commit 0dc6721
Show file tree

Hide file tree

Showing 4 changed files with 12 additions and 21 deletions.
diff --git a/.github/workflows/builder.yml b/.github/workflows/builder.yml
@@ -6,7 +6,10 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
-
+    permissions:
+      id-token: write
+      packages: write
+      contents: read
     env:
       GOLANG_CROSS_TAG: "v1.17.6-1"
 
@@ -41,11 +44,11 @@ jobs:
     - name: Sign the images
       run: |
           echo "${DOCKER_PASSWD}" | docker login -u ${{ steps.get_repo_owner.outputs.repo_owner }} --password-stdin ghcr.io
-          cosign sign --force --key=cosign.key ghcr.io/${{ steps.get_repo_owner.outputs.repo_owner }}/golang-cross-builder:${{ env.GOLANG_CROSS_TAG }}
+          cosign sign --force ghcr.io/${{ steps.get_repo_owner.outputs.repo_owner }}/golang-cross-builder:${{ env.GOLANG_CROSS_TAG }}
           docker logout
 
           echo "${DOCKER_PASSWD}" | docker login -u ${{ steps.get_repo_owner.outputs.repo_owner }} --password-stdin docker.pkg.github.com
-          cosign sign --force --key=cosign.key docker.pkg.github.com/${{ steps.get_repo_owner.outputs.repo_owner }}/golang-cross/golang-cross-builder:${{ env.GOLANG_CROSS_TAG }}
+          cosign sign --force docker.pkg.github.com/${{ steps.get_repo_owner.outputs.repo_owner }}/golang-cross/golang-cross-builder:${{ env.GOLANG_CROSS_TAG }}
           docker logout
       shell: bash
       env:

diff --git a/.github/workflows/release-golang-cross.yml b/.github/workflows/release-golang-cross.yml
@@ -7,8 +7,11 @@ on:
 
 jobs:
   build:
+    permissions:
+      id-token: write
+      packages: write
+      contents: read
     runs-on: ubuntu-latest
-
     steps:
     - uses: actions/checkout@v2
     - uses: sigstore/cosign-installer@v1.4.1
@@ -42,11 +45,11 @@ jobs:
     - name: Sign the images
       run: |
           echo "${DOCKER_PASSWD}" | docker login -u ${{ steps.get_repo_owner.outputs.repo_owner }} --password-stdin ghcr.io
-          cosign sign --force --key=cosign.key ghcr.io/${{ steps.get_repo_owner.outputs.repo_owner }}/golang-cross:${{ steps.get_tag.outputs.release_tag }}
+          cosign sign --force ghcr.io/${{ steps.get_repo_owner.outputs.repo_owner }}/golang-cross:${{ steps.get_tag.outputs.release_tag }}
           docker logout
 
           echo "${DOCKER_PASSWD}" | docker login -u ${{ steps.get_repo_owner.outputs.repo_owner }} --password-stdin docker.pkg.github.com
-          cosign sign --force --key=cosign.key ghcr.io/${{ steps.get_repo_owner.outputs.repo_owner }}/golang-cross/xcgo:${{ steps.get_tag.outputs.release_tag }}
+          cosign sign --force ghcr.io/${{ steps.get_repo_owner.outputs.repo_owner }}/golang-cross/xcgo:${{ steps.get_tag.outputs.release_tag }}
           docker logout
       shell: bash
       env:

diff --git a/cosign.key b/cosign.key
diff --git a/cosign.pub b/cosign.pub