From be87d12e597162029186715fcc08431cad7f0618 Mon Sep 17 00:00:00 2001 From: Stefan Prodan Date: Thu, 20 Jan 2022 15:04:08 +0200 Subject: [PATCH] Publish SBOM and sign release artifacts Signed-off-by: Stefan Prodan --- .github/workflows/release.yml | 57 ++++++++++++++++++++--------------- .goreleaser.yaml | 39 ++++++++++++++++++++++++ Dockerfile | 2 -- 3 files changed, 72 insertions(+), 26 deletions(-) create mode 100644 .goreleaser.yaml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9204fa83..c20c3d6d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -10,6 +10,11 @@ on: default: 'rc' required: true +permissions: + contents: write # needed to write releases + id-token: write # needed for keyless signing + packages: write # needed for ghcr access + env: CONTROLLER: ${{ github.event.repository.name }} @@ -31,13 +36,9 @@ jobs: echo ::set-output name=VERSION::${VERSION} - name: Setup QEMU uses: docker/setup-qemu-action@v1 - with: - platforms: all - name: Setup Docker Buildx id: buildx uses: docker/setup-buildx-action@v1 - with: - buildkitd-flags: "--debug" - name: Login to GitHub Container Registry uses: docker/login-action@v1 with: @@ -49,7 +50,16 @@ jobs: with: username: fluxcdbot password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }} - - name: Publish multi-arch container image + - name: Generate images meta + id: meta + uses: docker/metadata-action@v3 + with: + images: | + fluxcd/${{ env.CONTROLLER }} + ghcr.io/fluxcd/${{ env.CONTROLLER }} + tags: | + type=raw,value=${{ steps.prep.outputs.VERSION }} + - name: Publish images uses: docker/build-push-action@v2 with: push: true @@ -57,35 +67,34 @@ jobs: context: . file: ./Dockerfile platforms: linux/amd64,linux/arm/v7,linux/arm64 - tags: | - ghcr.io/fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.VERSION }} - docker.io/fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.VERSION }} - labels: | - org.opencontainers.image.title=${{ github.event.repository.name }} - org.opencontainers.image.description=${{ github.event.repository.description }} - org.opencontainers.image.url=${{ github.event.repository.html_url }} - org.opencontainers.image.revision=${{ github.sha }} - org.opencontainers.image.version=${{ steps.prep.outputs.VERSION }} - org.opencontainers.image.created=${{ steps.prep.outputs.BUILD_DATE }} + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} - name: Check images run: | docker buildx imagetools inspect docker.io/fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.VERSION }} docker buildx imagetools inspect ghcr.io/fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.VERSION }} docker pull docker.io/fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.VERSION }} docker pull ghcr.io/fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.VERSION }} - - name: Generate release manifests + - uses: sigstore/cosign-installer@main + - name: Sign images + env: + COSIGN_EXPERIMENTAL: 1 + run: | + cosign sign fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.VERSION }} + cosign sign ghcr.io/fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.VERSION }} + - name: Generate release artifacts if: startsWith(github.ref, 'refs/tags/v') run: | mkdir -p config/release kustomize build ./config/crd > ./config/release/${{ env.CONTROLLER }}.crds.yaml kustomize build ./config/manager > ./config/release/${{ env.CONTROLLER }}.deployment.yaml - - name: Create release + echo '[CHANGELOG](https://github.com/fluxcd/${{ env.CONTROLLER }}/blob/main/CHANGELOG.md)' > ./config/release/notes.md + - uses: anchore/sbom-action/download-syft@v0 + - name: Create release and SBOM if: startsWith(github.ref, 'refs/tags/v') - uses: ncipollo/release-action@v1 + uses: goreleaser/goreleaser-action@v2 with: - prerelease: true - artifacts: "config/release/*.yaml" - artifactContentType: "text/plain" - body: | - [CHANGELOG](https://github.com/fluxcd/${{ env.CONTROLLER }}/blob/main/CHANGELOG.md) - token: ${{ secrets.GITHUB_TOKEN }} + version: latest + args: release --release-notes=config/release/notes.md --rm-dist --skip-validate + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.goreleaser.yaml b/.goreleaser.yaml new file mode 100644 index 00000000..9d887aa6 --- /dev/null +++ b/.goreleaser.yaml @@ -0,0 +1,39 @@ +project_name: kustomize-controller + +builds: + - skip: true + +release: + prerelease: "true" + extra_files: + - glob: config/release/*.yaml + +checksum: + extra_files: + - glob: config/release/*.yaml + +source: + enabled: true + name_template: "{{ .ProjectName }}_{{ .Version }}_source_code" + +sboms: + - id: source + artifacts: source + documents: + - "{{ .ProjectName }}_{{ .Version }}_sbom.spdx.json" + +# signs the checksum file +# all files (including the sboms) are included in the checksum +# https://goreleaser.com/customization/sign +signs: + - cmd: cosign + env: + - COSIGN_EXPERIMENTAL=1 + certificate: "${artifact}.pem" + args: + - sign-blob + - "--output-certificate=${certificate}" + - "--output-signature=${signature}" + - "${artifact}" + artifacts: checksum + output: true diff --git a/Dockerfile b/Dockerfile index a4e99a99..a0de744b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -33,8 +33,6 @@ RUN xx-go build -a -o kustomize-controller main.go FROM alpine:3.15 -LABEL org.opencontainers.image.source="https://github.com/fluxcd/kustomize-controller" - RUN apk add --no-cache ca-certificates tini git openssh-client gnupg COPY --from=builder /workspace/kustomize-controller /usr/local/bin/