ci: Move to cosign v3#4953
Draft
sayboras wants to merge 3 commits into
Draft
Conversation
sayboras
added
area/ci
sayboras
force-pushed
the
pr/tammach/cosign-action
branch
from
deb2de5 to
418418f
Compare
✅ Deploy Preview for tetragon ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Centralize image signing and SBOM publication into a composite action mirroring cilium/cilium .github/actions/cosign so the three image build workflows can drop their duplicated install-cosign + sign + bom + attach-sbom + sign-sbom step blocks. Signed-off-by: Tam Mach <tam.mach@cilium.io>
sayboras
force-pushed
the
pr/tammach/cosign-action
branch
2 times, most recently
from
33b5066 to
9ba5bfb
Compare
Replace the duplicated Install-Cosign + Sign + Install-Go + Install-Bom + Generate-SBOM + Attach-SBOM + Sign-SBOM step blocks in the three image build workflows with calls into the new .github/actions/cosign composite action. Behavioral changes carried by the new action: - cosign-installer v3.1.2 -> v4.1.1. - SBOM generation: kubernetes-sigs/bom -> anchore/sbom-action (.spdx -> .spdx.json). - SBOM publication: deprecated 'cosign attach sbom' (raw blob attached by digest) -> 'cosign attest --type spdxjson' (in-toto attestation). Consumers must switch from 'cosign verify' against the .sbom artifact to 'cosign verify-attestation --type spdxjson'. Signed-off-by: Tam Mach <tam.mach@cilium.io>
Signed-off-by: Tam Mach <tam.mach@cilium.io>
sayboras
force-pushed
the
pr/tammach/cosign-action
branch
from
9ba5bfb to
bf43b1d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The current cosign-installer v3.x.x was the last release for cosign v2, it's better to transition to v3 with more recent cosign-installer.
https://github.com/sigstore/cosign-installer/releases/tag/v3.10.1
Changelog