Use cosign to verify the release and update chart-testing to v3.8.0 (#…

…116) * use cosign to verify the release artifact Signed-off-by: cpanato <[email protected]> * bump chart-testing to v3.8.0 Signed-off-by: cpanato <[email protected]> --------- Signed-off-by: cpanato <[email protected]>
helm · Mar 24, 2023 · e878887 · e878887
1 parent 68148c9
commit e878887
Show file tree

Hide file tree

Showing 4 changed files with 26 additions and 14 deletions.
diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml
@@ -16,8 +16,8 @@ jobs:
         ct version
         CT_VERSION_OUTPUT=$(ct version 2>&1 /dev/null)
         ACTUAL_VERSION=$(echo "$CT_VERSION_OUTPUT" | grep Version | rev | cut -d ' ' -f1 | rev)
-        if [[ $ACTUAL_VERSION != 'v3.7.1' ]]; then
-          echo 'should be v3.7.1'
+        if [[ $ACTUAL_VERSION != 'v3.8.0' ]]; then
+          echo 'should be v3.8.0'
           exit 1
         else
           exit 0
@@ -41,16 +41,16 @@ jobs:
     - name: Install chart-testing
       uses: ./
       with:
-        version: 'v3.5.1'
+        version: 'v3.7.1'
         yamllint_version: '1.27.1'
         yamale_version: '3.0.4'
     - name: Check install!
       run: |
         ct version
         CT_VERSION_OUTPUT=$(ct version 2>&1 /dev/null)
         ACTUAL_VERSION=$(echo "$CT_VERSION_OUTPUT" | grep Version | rev | cut -d ' ' -f1 | rev)
-        if [[ $ACTUAL_VERSION != 'v3.5.1' ]]; then
-          echo 'should be v3.5.1'
+        if [[ $ACTUAL_VERSION != 'v3.7.1' ]]; then
+          echo 'should be v3.7.1'
           exit 1
         else
           exit 0

diff --git a/README.md b/README.md
@@ -15,7 +15,7 @@ A GitHub Action for installing the [helm/chart-testing](https://github.com/helm/
 
 For more information on inputs, see the [API Documentation](https://developer.github.com/v3/repos/releases/#input)
 
-- `version`: The chart-testing version to install (default: `v3.7.1`)
+- `version`: The chart-testing version to install (default: `v3.8.0`)
 - `yamllint_version`: The chart-testing version to install (default: `1.27.1`)
 - `yamale_version`: The chart-testing version to install (default: `3.0.4`)
 
@@ -44,15 +44,15 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@v3
         with:
-          version: v3.10.0
+          version: v3.11.2
 
       - uses: actions/setup-python@v4
         with:
           python-version: '3.9'
           check-latest: true
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2.3.1
+        uses: helm/chart-testing-action@v2.4.0
 
       - name: Run chart-testing (list-changed)
         id: list-changed
@@ -67,13 +67,12 @@ jobs:
         run: ct lint --target-branch ${{ github.event.repository.default_branch }}
 
       - name: Create kind cluster
-        uses: helm/[email protected]
         if: steps.list-changed.outputs.changed == 'true'
+        uses: helm/[email protected]
 
       - name: Run chart-testing (install)
-        run: ct install --target-branch ${{ github.event.repository.default_branch }}
         if: steps.list-changed.outputs.changed == 'true'
-
+        run: ct install --target-branch ${{ github.event.repository.default_branch }}
 ```
 
 This uses [`helm/kind-action`](https://www.github.com/helm/kind-action) GitHub Action to spin up a [kind](https://kind.sigs.k8s.io/) Kubernetes cluster,

diff --git a/action.yml b/action.yml
@@ -6,9 +6,9 @@ branding:
   icon: anchor
 inputs:
   version:
-    description: "The chart-testing version to install (default: v3.7.1)"
+    description: "The chart-testing version to install (default: v3.8.0)"
     required: false
-    default: v3.7.1
+    default: v3.8.0
   yamllint_version:
     description: "The yamllint version to install (default: 1.27.1)"
     required: false
@@ -20,6 +20,7 @@ inputs:
 runs:
   using: composite
   steps:
+    - uses: sigstore/cosign-installer@c3667d99424e7e6047999fb6246c0da843953c65 # v3.0.1
     - run: |
         cd $GITHUB_ACTION_PATH \
         && ./ct.sh \

diff --git a/ct.sh b/ct.sh
@@ -4,7 +4,7 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-DEFAULT_CHART_TESTING_VERSION=v3.7.1
+DEFAULT_CHART_TESTING_VERSION=v3.8.0
 DEFAULT_YAMLLINT_VERSION=1.27.1
 DEFAULT_YAMALE_VERSION=3.0.4
 
@@ -88,7 +88,19 @@ install_chart_testing() {
         mkdir -p "$cache_dir"
 
         echo "Installing chart-testing ${version}..."
+        CT_CERT=https://github.com/helm/chart-testing/releases/download/$version/chart-testing_${version#v}_linux_amd64.tar.gz.pem
+        CT_SIG=https://github.com/helm/chart-testing/releases/download/$version/chart-testing_${version#v}_linux_amd64.tar.gz.sig
+
         curl --retry 5 --retry-delay 1 -sSLo ct.tar.gz "https://github.com/helm/chart-testing/releases/download/$version/chart-testing_${version#v}_linux_amd64.tar.gz"
+        cosign verify-blob --certificate $CT_CERT --signature $CT_SIG \
+          --certificate-identity "https://github.com/helm/chart-testing/.github/workflows/release.yaml@refs/heads/main" \
+          --certificate-oidc-issuer "https://token.actions.githubusercontent.com" ct.tar.gz
+        retVal=$?
+        if [[ "$retVal" -ne 0 ]]; then
+          log_error "Unable to validate chart-testing version: ${version}"
+          exit 1
+        fi
+
         tar -xzf ct.tar.gz -C "$cache_dir"
         rm -f ct.tar.gz