feat: add image attestation workflow step #5158
Conversation
Signed-off-by: Dan Urson <[email protected]>
notdurson
requested review from
GenPage,
nitrocode and
X-Guardian
and removed request for
a team
jamengual
changed the title
Signed-off-by: Dan Urson <[email protected]>
|
Looks like this needs some additional permissions per step one of the action's docs. |
Signed-off-by: Dan Urson <[email protected]>
|
I can't see the vuln that Fossa's complaining about. @nitrocode can you take a look? |
|
Signed-off-by: Dan Urson <[email protected]>
Per @robertchrk, reference `image-name@digest` instead of `name` Co-authored-by: Robert Kugler <[email protected]> Signed-off-by: Dan Urson <[email protected]>
Co-authored-by: Robert Kugler <[email protected]> Signed-off-by: Dan Urson <[email protected]>
Signed-off-by: Dan Urson <[email protected]>
|
Thanks for the contribution! Could you test this out in your fork by merging your |
|
the vulnerbility issue should be fixed per #5165 |
Co-authored-by: RB <[email protected]> Signed-off-by: Rui Chen <[email protected]>
chenrui333
changed the title
break attestation into its own workflow Signed-off-by: Dan Urson <[email protected]> add permissions back to attestation workflow Signed-off-by: Dan Urson <[email protected]> delete independent attestation wf it's supposed to be contained in the build wf per github best practices Signed-off-by: Dan Urson <[email protected]> add back modified build workflow contains updated attestation step Signed-off-by: Dan Urson <[email protected]> aparently the tag is the path wtf Signed-off-by: Dan Urson <[email protected]> try again with the bare repo name as the path Signed-off-by: Dan Urson <[email protected]> Test Signed-off-by: Dan Urson <[email protected]> Co-authored-by: Robert Kugler <[email protected]> Fix digest Signed-off-by: Dan Urson <[email protected]> Co-authored-by: Robert Kugler <[email protected]> Fix subject name Signed-off-by: Dan Urson <[email protected]> Co-authored-by: Robert Kugler <[email protected]> Try variable Signed-off-by: Dan Urson <[email protected]> Co-authored-by: Robert Kugler <[email protected]>
|
@nitrocode @chenrui333 Friends, thank you for your patience. We conducted some additional tests and were able to successfully sign/attest to an image in my fork. I would appreciate it if you could review the most recent commit here, and give it a maintainer-grade 👍 if you're okay with it. |
Signed-off-by: Dan Urson <[email protected]>
Signed-off-by: Dan Urson <[email protected]>
Signed-off-by: Dan Urson <[email protected]>
Signed-off-by: Dan Urson <[email protected]>
|
@jamengual ok - it's still failing, but that's expected. it's because we're hitting this issue in the attest-build-provenance action - tl;dr, the action won't run if it's run as part of a merge from a fork, the merge has to be completed from a branch in the same repo. in my fork, the attestation works on the latest build. are you comfortable approving a merge with this in mind? |
what
why
tests
cosignrun was successful.references