Skip to content

Commit

Permalink
test: signing
Browse files Browse the repository at this point in the history
Signed-off-by: Bence Csati <[email protected]>
  • Loading branch information
csatib02 committed Nov 28, 2024
1 parent 7536980 commit cd34ab0
Showing 1 changed file with 2 additions and 4 deletions.
6 changes: 2 additions & 4 deletions .github/workflows/artifacts.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -456,7 +456,6 @@ jobs:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ github.token }}
if: inputs.publish && inputs.release

- name: Helm push
id: push
Expand All @@ -465,16 +464,15 @@ jobs:
echo "digest=$(awk '/Digest: /{print $2}' push-metadata.txt)" >> "$GITHUB_OUTPUT"
env:
HELM_REGISTRY_CONFIG: ~/.docker/config.json
if: inputs.publish && inputs.release

- name: Sign chart with GitHub OIDC Token
if: ${{ inputs.publish && inputs.release && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
if: ${{ github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
env:
DIGEST: ${{ steps.push.outputs.digest }}
run: cosign sign --yes --rekor-url "https://rekor.sigstore.dev/" "${{ steps.oci-chart-name.outputs.value }}@${DIGEST}"

- name: Verify signed chart with cosign
if: ${{ inputs.publish && inputs.release && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
if: ${{ github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
env:
DIGEST: ${{ steps.push.outputs.digest }}
run: |
Expand Down

0 comments on commit cd34ab0

Please sign in to comment.