scottk/secureblue
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/secureblue.git synced 2025-11-20 12:04:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor: avoid subshell, sign image with env. var (#30)

Browse Source 
Works in main, propagating here.

Co-authored-by: xnasero@posteo.net
This commit is contained in:
Jorge O. Castro
2023-04-24 13:31:03 -04:00
committed by GitHub
parent 56a1d24a83
commit 328595b77d
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
.github/workflows/build.yml vendored
View File

@@ -58,7 +58,7 @@ jobs:
COMMIT_TAGS=() COMMIT_TAGS=()
BUILD_TAGS=() BUILD_TAGS=()
# Have tags for tracking builds during pull request # Have tags for tracking builds during pull request
SHA_SHORT="$(git rev-parse --short HEAD)" SHA_SHORT="${GITHUB_SHA::7}"
COMMIT_TAGS+=("pr-${{ github.event.number }}-${MAJOR_VERSION}") COMMIT_TAGS+=("pr-${{ github.event.number }}-${MAJOR_VERSION}")
COMMIT_TAGS+=("${SHA_SHORT}-${MAJOR_VERSION}") COMMIT_TAGS+=("${SHA_SHORT}-${MAJOR_VERSION}")
@@ -142,10 +142,10 @@ jobs:
# Only needed when running `cosign sign` using a key # Only needed when running `cosign sign` using a key
- name: Write signing key to disk - name: Write signing key to disk
run: | run: |
echo "${{ env.COSIGN_PRIVATE_KEY }}" > cosign.key cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}@${TAGS}
# DEBUG: get character count of key
wc -c cosign.key
env: env:
TAGS: ${{ steps.push.outputs.digest }}
COSIGN_EXPERIMENTAL: false
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
- name: Login to GitHub Container Registry - name: Login to GitHub Container Registry