feedc0de/my-rook-config
1
0 Fork 0
forked from rook/rook
Code Pull Requests Activity

Merge pull request #16374 from subhamkrai/add-cosign

Browse Source 
build: use cosign to sign the images/helm charts
This commit is contained in:
Travis Nielsen authored and GitHub committed 2025-09-19 07:11:13 -06:00
2 parents 270d4d4c65 7dd21a0468
commit c177bf1d4d
2 files changed
+9 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/workflows/push-build.yaml
+4
View File
@@ -15,6 +15,7 @@ defaults:
permissions:
contents: read
packages: write
id-token: write # for cosign OIDC keyless signing
jobs:
push-image-to-container-registry:
@@ -36,6 +37,9 @@ jobs:
with:
platforms: all
- name: Install cosign
uses: sigstore/cosign-installer@4ea7c83ed23e5b1b86ff0db87c63b87e4d72c410 # v3.8.0
- name: log in to container registry
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
with:
build/release/Makefile
+5 -1
View File
@@ -156,6 +156,7 @@ define chart.targets
promote.chart.$(1).$(2):
@echo === helm push $(2) to $(1)
$(HELM) push $(HELM_OUTPUT_DIR)/$(2)-$(HELM_CHART_VERSION).tgz oci://$(1)
cosign sign --yes $(1)/$(2):$(HELM_CHART_VERSION)
promote.all.charts: promote.chart.$(1).$(2)
endef
$(foreach r,$(REGISTRIES), $(foreach c,$(HELM_CHARTS),$(eval $(call chart.targets,$(r),$(c)))))
@@ -184,6 +185,8 @@ build.all.images: build.image.$(1).$(2)
publish.image.$(1).$(2):
@$(DOCKERCMD) push $(1)/ceph-$(2):$(VERSION)
@$(DOCKERCMD) push $(1)/ceph-$(2):$(BRANCH_NAME)
cosign sign --yes $(1)/ceph-$(2):$(VERSION)
cosign sign --yes $(1)/ceph-$(2):$(BRANCH_NAME)
publish.all.images.$(1): publish.image.$(1).$(2)
endef
@@ -193,12 +196,13 @@ define repo.manifest.targets
publish.manifest.image.$(1): publish.all.images.$(1) $(MANIFEST_TOOL)
$(MANIFEST_TOOL) push from-args --platforms $(IMAGE_PLATFORMS_COMMA) --template $(1)/ceph-ARCH:$(VERSION) --target $(1)/ceph:$(VERSION)
$(MANIFEST_TOOL) push from-args --platforms $(IMAGE_PLATFORMS_COMMA) --template $(1)/ceph-ARCH:$(BRANCH_NAME) --target $(1)/ceph:$(BRANCH_NAME)
cosign sign --yes $(1)/ceph:$(VERSION)
cosign sign --yes $(1)/ceph:$(BRANCH_NAME)
publish.images: publish.manifest.image.$(1)
endef
$(foreach r,$(REGISTRIES),$(eval $(call repo.manifest.targets,$(r))))
build.images: build.all.images
build.charts: build.all.charts
promote.charts: promote.all.charts