Skip to content

Commit 7d5db0d

Browse files
rdimitrovrdimitrov
authoredMar 5, 2024
Add example workflows and make targets for demo-repo-go (#23)
* Update gitignore Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com> * Add the workflows, makefiles and everything else Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com> --------- Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
1 parent ddc177a commit 7d5db0d

20 files changed

+655
-143
lines changed
 

‎.github/dependabot.yml

-7
This file was deleted.

‎.github/workflows/build-binary-signed-ghat-malicious.yml

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: binary-signed-ghat-malicious
2+
3+
on:
4+
workflow_dispatch:
5+
6+
jobs:
7+
build:
8+
permissions:
9+
id-token: write
10+
packages: write
11+
contents: write
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Check out code
15+
uses: actions/checkout@v4
16+
17+
- name: The malicious step
18+
run: |
19+
echo "// This is a malicious update" >> main.go
20+
21+
- name: Set up Go
22+
uses: actions/setup-go@v5
23+
with:
24+
go-version: '1.21'
25+
26+
- name: Run Go build
27+
run: |
28+
go build -v -o demo-repo-go-binary ./...
29+
30+
- name: Sign artifact
31+
uses: github-early-access/generate-build-provenance@main
32+
with:
33+
subject-path: '${{ github.workspace }}/demo-repo-go-binary'
34+
35+
- name: Upload artifact
36+
uses: actions/upload-artifact@v3
37+
with:
38+
name: demo-repo-go-binary
39+
path: demo-repo-go-binary

‎.github/workflows/build-binary-signed-ghat.yml

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: binary-signed-ghat
2+
3+
on:
4+
workflow_dispatch:
5+
6+
jobs:
7+
build:
8+
permissions:
9+
id-token: write
10+
packages: write
11+
contents: write
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Check out code
15+
uses: actions/checkout@v4
16+
17+
- name: Set up Go
18+
uses: actions/setup-go@v5
19+
with:
20+
go-version: '1.21'
21+
22+
- name: Run Go build
23+
run: |
24+
go build -v -o demo-repo-go-binary ./...
25+
26+
- name: Sign artifact
27+
uses: github-early-access/generate-build-provenance@main
28+
with:
29+
subject-path: '${{ github.workspace }}/demo-repo-go-binary'
30+
31+
- name: Upload artifact
32+
uses: actions/upload-artifact@v3
33+
with:
34+
name: demo-repo-go-binary
35+
path: demo-repo-go-binary

‎.github/workflows/build-binary-unsigned.yml

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: binary-unsigned
2+
3+
on:
4+
workflow_dispatch:
5+
6+
jobs:
7+
build:
8+
permissions:
9+
id-token: write
10+
packages: write
11+
contents: write
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Check out code
15+
uses: actions/checkout@v4
16+
17+
- name: Set up Go
18+
uses: actions/setup-go@v5
19+
with:
20+
go-version: '1.21'
21+
22+
- name: Run Go build
23+
run: |
24+
go build -v -o demo-repo-go-binary ./...
25+
26+
# - name: Sign artifact
27+
# uses: github-early-access/generate-build-provenance@main
28+
# with:
29+
# subject-path: '${{ github.workspace }}/demo-repo-go-binary'
30+
31+
- name: Upload artifact
32+
uses: actions/upload-artifact@v3
33+
with:
34+
name: demo-repo-go-binary
35+
path: demo-repo-go-binary

‎.github/workflows/build-image-signed-cosign-malicious.yml

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: image-signed-cosign(latest,daily)-malicious
2+
on:
3+
workflow_dispatch:
4+
5+
env:
6+
REGISTRY: ghcr.io
7+
IMAGE_NAME: ${{ github.repository }}
8+
9+
jobs:
10+
build:
11+
12+
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
15+
packages: write
16+
id-token: write
17+
18+
steps:
19+
- name: Checkout repository
20+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
21+
22+
- name: The malicious step
23+
run: |
24+
echo "// This is a malicious update" >> main.go
25+
26+
- name: Install Cosign
27+
uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1
28+
with:
29+
cosign-release: 'v2.1.1'
30+
31+
- name: Setup Docker buildx
32+
uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf
33+
34+
- name: Log into registry ${{ env.REGISTRY }}
35+
uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
36+
with:
37+
registry: ${{ env.REGISTRY }}
38+
username: ${{ github.actor }}
39+
password: ${{ secrets.GITHUB_TOKEN }}
40+
41+
- name: Extract Docker metadata
42+
id: meta
43+
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
44+
with:
45+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
46+
47+
- name: Build and push Docker image
48+
id: build-and-push
49+
uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
50+
with:
51+
context: .
52+
push: ${{ github.event_name != 'pull_request' }}
53+
tags: ghcr.io/${{ github.repository }}:latest,ghcr.io/${{ github.repository }}:daily
54+
labels: ${{ steps.meta.outputs.labels }}
55+
cache-from: type=gha
56+
cache-to: type=gha,mode=max
57+
58+
59+
- name: Sign the published Docker image
60+
env:
61+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
62+
run: |
63+
echo "ghcr.io/${{ github.repository }}:daily" | xargs -I {} cosign sign --yes {}@${DIGEST}
64+
echo "ghcr.io/${{ github.repository }}:latest" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎.github/workflows/build-image-signed-cosign-static-copied.yml

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: image-signed-cosign(static)-copied
2+
on:
3+
workflow_dispatch:
4+
5+
env:
6+
REGISTRY: ghcr.io
7+
IMAGE_NAME: ${{ github.repository }}
8+
9+
jobs:
10+
build:
11+
12+
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
15+
packages: write
16+
id-token: write
17+
18+
steps:
19+
- name: Checkout repository
20+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
21+
22+
- name: Install Cosign
23+
uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1
24+
with:
25+
cosign-release: 'v2.1.1'
26+
27+
- name: Setup Docker buildx
28+
uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf
29+
30+
- name: Log into registry ${{ env.REGISTRY }}
31+
uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
32+
with:
33+
registry: ${{ env.REGISTRY }}
34+
username: ${{ github.actor }}
35+
password: ${{ secrets.GITHUB_TOKEN }}
36+
37+
- name: Extract Docker metadata
38+
id: meta
39+
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
40+
with:
41+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
42+
43+
- name: Build and push Docker image
44+
id: build-and-push
45+
uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
46+
with:
47+
push: true
48+
tags: ghcr.io/${{ github.repository }}:static
49+
context: .
50+
file : Dockerfile.static
51+
52+
53+
- name: Sign the published Docker image
54+
env:
55+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
56+
run: |
57+
echo "ghcr.io/${{ github.repository }}:static" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎.github/workflows/build-image-signed-cosign-static.yml

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: image-signed-cosign(static)
2+
on:
3+
workflow_dispatch:
4+
5+
env:
6+
REGISTRY: ghcr.io
7+
IMAGE_NAME: ${{ github.repository }}
8+
9+
jobs:
10+
build:
11+
12+
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
15+
packages: write
16+
id-token: write
17+
18+
steps:
19+
- name: Checkout repository
20+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
21+
22+
- name: Install Cosign
23+
uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1
24+
with:
25+
cosign-release: 'v2.1.1'
26+
27+
- name: Setup Docker buildx
28+
uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf
29+
30+
- name: Log into registry ${{ env.REGISTRY }}
31+
uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
32+
with:
33+
registry: ${{ env.REGISTRY }}
34+
username: ${{ github.actor }}
35+
password: ${{ secrets.GITHUB_TOKEN }}
36+
37+
- name: Extract Docker metadata
38+
id: meta
39+
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
40+
with:
41+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
42+
43+
- name: Build and push Docker image
44+
id: build-and-push
45+
uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
46+
with:
47+
push: true
48+
tags: ghcr.io/${{ github.repository }}:static
49+
context: .
50+
file : Dockerfile.static
51+
52+
53+
- name: Sign the published Docker image
54+
env:
55+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
56+
run: |
57+
echo "ghcr.io/${{ github.repository }}:static" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎.github/workflows/build-image-signed-cosign.yml

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: image-signed-cosign(latest,daily)
2+
on:
3+
workflow_dispatch:
4+
5+
env:
6+
REGISTRY: ghcr.io
7+
IMAGE_NAME: ${{ github.repository }}
8+
9+
jobs:
10+
build:
11+
12+
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
15+
packages: write
16+
id-token: write
17+
18+
steps:
19+
- name: Checkout repository
20+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
21+
22+
- name: Install Cosign
23+
uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1
24+
with:
25+
cosign-release: 'v2.1.1'
26+
27+
- name: Setup Docker buildx
28+
uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf
29+
30+
- name: Log into registry ${{ env.REGISTRY }}
31+
uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
32+
with:
33+
registry: ${{ env.REGISTRY }}
34+
username: ${{ github.actor }}
35+
password: ${{ secrets.GITHUB_TOKEN }}
36+
37+
- name: Extract Docker metadata
38+
id: meta
39+
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
40+
with:
41+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
42+
43+
- name: Build and push Docker image
44+
id: build-and-push
45+
uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
46+
with:
47+
context: .
48+
push: ${{ github.event_name != 'pull_request' }}
49+
tags: ghcr.io/${{ github.repository }}:latest,ghcr.io/${{ github.repository }}:daily
50+
labels: ${{ steps.meta.outputs.labels }}
51+
cache-from: type=gha
52+
cache-to: type=gha,mode=max
53+
54+
55+
- name: Sign the published Docker image
56+
env:
57+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
58+
run: |
59+
echo "ghcr.io/${{ github.repository }}:daily" | xargs -I {} cosign sign --yes {}@${DIGEST}
60+
echo "ghcr.io/${{ github.repository }}:latest" | xargs -I {} cosign sign --yes {}@${DIGEST}

0 commit comments

Comments
 (0)