🌱 bump the github-actions group across 1 directory with 3 up… #24
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: goreleaser | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: false | |
| permissions: {} | |
| jobs: | |
| goreleaser: | |
| outputs: | |
| hashes: ${{ steps.binary.outputs.hashes }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| id-token: write # sign archives with cosign | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - name: Update goreportcard | |
| uses: creekorful/goreportcard-action@1f35ced8cdac2cba28c9a2f2288a16aacfd507f9 # v1.0 | |
| - name: Setup go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| check-latest: true | |
| cache: false | |
| - name: Install Syft | |
| uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| - name: Run GoReleaser | |
| id: goreleaser | |
| uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2 | |
| with: | |
| version: '~> v2' | |
| args: release --clean | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Generate binary hashes | |
| id: binary | |
| env: | |
| ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}" | |
| run: | | |
| set -euo pipefail | |
| checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path') | |
| echo "hashes=$(cat $checksum_file | base64 -w0)" >> "$GITHUB_OUTPUT" | |
| ko-publish: | |
| outputs: | |
| digest: ${{ steps.release.outputs.digest }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| packages: write | |
| id-token: write # sign archives with cosign | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - name: Setup go | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| check-latest: true | |
| cache: false | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| - name: Publish alertmanager-uptime-kuma-push | |
| id: release | |
| uses: ./.github/actions/publish-image | |
| with: | |
| makefile-target: ko-publish | |
| registry: ghcr.io | |
| registry-username: ${{ github.actor }} | |
| registry-password: ${{ secrets.GITHUB_TOKEN }} | |
| repository: ${{ github.repository_owner }} | |
| version: ${{ github.ref_name }} | |
| sign-image: true | |
| sbom-name: alertmanager-uptime-kuma-push | |
| main-path: ./cmd/pusher | |
| binary-provenance: | |
| needs: [goreleaser] | |
| permissions: | |
| actions: read # To read the workflow path. | |
| id-token: write # To sign the provenance (fetch an OIDC token from GitHub) | |
| contents: write # To add assets to a release. | |
| # MUST be referenced by tag (see https://github.com/slsa-framework/slsa-github-generator/?tab=readme-ov-file#referencing-slsa-builders-and-generators) | |
| uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0 | |
| with: | |
| base64-subjects: "${{ needs.goreleaser.outputs.hashes }}" | |
| upload-assets: true # upload to a new release | |
| draft-release: true | |
| image-provenance: | |
| needs: [ko-publish] | |
| permissions: | |
| actions: read | |
| id-token: write | |
| packages: write | |
| # MUST be referenced by tag (see https://github.com/slsa-framework/slsa-github-generator/?tab=readme-ov-file#referencing-slsa-builders-and-generators) | |
| uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0 | |
| with: | |
| image: ghcr.io/${{ github.repository_owner }}/alertmanager-uptime-kuma-push | |
| digest: ${{ needs.ko-publish.outputs.digest }} | |
| registry-username: ${{ github.actor }} | |
| secrets: | |
| registry-password: ${{ secrets.GITHUB_TOKEN }} | |
| verification-with-cosign: | |
| needs: [ko-publish, image-provenance] | |
| runs-on: ubuntu-latest | |
| permissions: read-all | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - name: Login | |
| uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| - name: Verify provenance of image | |
| env: | |
| IMAGE: ghcr.io/${{ github.repository_owner }}/alertmanager-uptime-kuma-push | |
| DIGEST: ${{ needs.ko-publish.outputs.digest }} | |
| run: | | |
| set -euo pipefail | |
| cosign verify-attestation \ | |
| --type slsaprovenance \ | |
| --new-bundle-format=false \ | |
| --certificate-oidc-issuer https://token.actions.githubusercontent.com \ | |
| --certificate-identity-regexp '^https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v[0-9]+.[0-9]+.[0-9]+$' \ | |
| --policy policy.cue \ | |
| $IMAGE@$DIGEST | |
| - name: Verify signature of image | |
| env: | |
| IMAGE: ghcr.io/${{ github.repository_owner }}/alertmanager-uptime-kuma-push | |
| DIGEST: ${{ needs.ko-publish.outputs.digest }} | |
| run: | | |
| set -euo pipefail | |
| cosign verify --new-bundle-format \ | |
| --certificate-oidc-issuer https://token.actions.githubusercontent.com \ | |
| --certificate-identity-regexp '^https://github.com/natrontech/alertmanager-uptime-kuma-push/.github/workflows/release.yml@refs/tags/v[0-9]+.[0-9]+.[0-9]+(-rc.[0-9]+)?$' \ | |
| $IMAGE@$DIGEST | |
| - name: Verify sbom of image | |
| env: | |
| IMAGE: ghcr.io/${{ github.repository_owner }}/alertmanager-uptime-kuma-push | |
| DIGEST: ${{ needs.ko-publish.outputs.digest }} | |
| run: | | |
| set -euo pipefail | |
| cosign verify-attestation --new-bundle-format \ | |
| --type cyclonedx \ | |
| --certificate-oidc-issuer https://token.actions.githubusercontent.com \ | |
| --certificate-identity-regexp '^https://github.com/natrontech/alertmanager-uptime-kuma-push/.github/workflows/release.yml@refs/tags/v[0-9]+.[0-9]+.[0-9]+(-rc.[0-9]+)?$' \ | |
| --policy policy-sbom.cue \ | |
| $IMAGE@$DIGEST |