|
|
@ -20,7 +20,7 @@ jobs:
|
|
|
|
packages: write # needed for ghcr access
|
|
|
|
packages: write # needed for ghcr access
|
|
|
|
steps:
|
|
|
|
steps:
|
|
|
|
- name: Checkout
|
|
|
|
- name: Checkout
|
|
|
|
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
|
|
|
|
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
|
|
|
|
- name: Unshallow
|
|
|
|
- name: Unshallow
|
|
|
|
run: git fetch --prune --unshallow
|
|
|
|
run: git fetch --prune --unshallow
|
|
|
|
- name: Setup Go
|
|
|
|
- name: Setup Go
|
|
|
@ -110,7 +110,7 @@ jobs:
|
|
|
|
id-token: write
|
|
|
|
id-token: write
|
|
|
|
packages: write
|
|
|
|
packages: write
|
|
|
|
steps:
|
|
|
|
steps:
|
|
|
|
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
|
|
|
|
- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
|
|
|
|
- name: Setup Kustomize
|
|
|
|
- name: Setup Kustomize
|
|
|
|
uses: fluxcd/pkg/actions/kustomize@main
|
|
|
|
uses: fluxcd/pkg/actions/kustomize@main
|
|
|
|
- name: Setup Flux CLI
|
|
|
|
- name: Setup Flux CLI
|
|
|
@ -176,7 +176,7 @@ jobs:
|
|
|
|
actions: read # for detecting the Github Actions environment.
|
|
|
|
actions: read # for detecting the Github Actions environment.
|
|
|
|
id-token: write # for creating OIDC tokens for signing.
|
|
|
|
id-token: write # for creating OIDC tokens for signing.
|
|
|
|
contents: write # for uploading attestations to GitHub releases.
|
|
|
|
contents: write # for uploading attestations to GitHub releases.
|
|
|
|
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.8.0
|
|
|
|
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0
|
|
|
|
with:
|
|
|
|
with:
|
|
|
|
provenance-name: "provenance.intoto.jsonl"
|
|
|
|
provenance-name: "provenance.intoto.jsonl"
|
|
|
|
base64-subjects: "${{ needs.release-flux-cli.outputs.hashes }}"
|
|
|
|
base64-subjects: "${{ needs.release-flux-cli.outputs.hashes }}"
|
|
|
@ -188,7 +188,7 @@ jobs:
|
|
|
|
actions: read # for detecting the Github Actions environment.
|
|
|
|
actions: read # for detecting the Github Actions environment.
|
|
|
|
id-token: write # for creating OIDC tokens for signing.
|
|
|
|
id-token: write # for creating OIDC tokens for signing.
|
|
|
|
packages: write # for uploading attestations.
|
|
|
|
packages: write # for uploading attestations.
|
|
|
|
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.8.0
|
|
|
|
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.9.0
|
|
|
|
with:
|
|
|
|
with:
|
|
|
|
image: ${{ needs.release-flux-cli.outputs.image_url }}
|
|
|
|
image: ${{ needs.release-flux-cli.outputs.image_url }}
|
|
|
|
digest: ${{ needs.release-flux-cli.outputs.image_digest }}
|
|
|
|
digest: ${{ needs.release-flux-cli.outputs.image_digest }}
|
|
|
@ -202,7 +202,7 @@ jobs:
|
|
|
|
actions: read # for detecting the Github Actions environment.
|
|
|
|
actions: read # for detecting the Github Actions environment.
|
|
|
|
id-token: write # for creating OIDC tokens for signing.
|
|
|
|
id-token: write # for creating OIDC tokens for signing.
|
|
|
|
packages: write # for uploading attestations.
|
|
|
|
packages: write # for uploading attestations.
|
|
|
|
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.8.0
|
|
|
|
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.9.0
|
|
|
|
with:
|
|
|
|
with:
|
|
|
|
image: ghcr.io/${{ needs.release-flux-cli.outputs.image_url }}
|
|
|
|
image: ghcr.io/${{ needs.release-flux-cli.outputs.image_url }}
|
|
|
|
digest: ${{ needs.release-flux-cli.outputs.image_digest }}
|
|
|
|
digest: ${{ needs.release-flux-cli.outputs.image_digest }}
|
|
|
|