Skip to content

Commit d3cee18

Browse files
wright-iowright-io
authored
Initial commit
0 parents  commit d3cee18

20 files changed

+1095
-0
lines changed

‎.github/workflows/build-binary-signed-ghat-malicious.yml

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: binary-signed-ghat-malicious
2+
3+
on:
4+
workflow_dispatch:
5+
6+
jobs:
7+
build:
8+
permissions:
9+
id-token: write
10+
packages: write
11+
contents: write
12+
attestations: write
13+
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Check out code
17+
uses: actions/checkout@v4
18+
19+
- name: The malicious step
20+
run: |
21+
echo "# This is a malicious update" >> app.py
22+
23+
# TODO: add that when we support artifacts other than containers
24+
#
25+
# - name: Build the binary
26+
# run: |
27+
# ...
28+
#
29+
# - name: Sign artifact
30+
# uses: actions/[email protected]
31+
# with:
32+
# subject-path: '${{ github.workspace }}/demo-repo-go-binary'
33+
#
34+
# - name: Upload artifact
35+
# uses: actions/upload-artifact@v3
36+
# with:
37+
# name: demo-repo-python-binary
38+
# path: demo-repo-python-binary

‎.github/workflows/build-binary-signed-ghat.yml

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: binary-signed-ghat
2+
3+
on:
4+
workflow_dispatch:
5+
6+
jobs:
7+
build:
8+
permissions:
9+
id-token: write
10+
packages: write
11+
contents: write
12+
attestations: write
13+
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Check out code
17+
uses: actions/checkout@v4
18+
19+
# TODO: add that when we support artifacts other than containers
20+
#
21+
# - name: Build the binary
22+
# run: |
23+
# ...
24+
#
25+
# - name: Sign artifact
26+
# uses: actions/[email protected]
27+
# with:
28+
# subject-path: '${{ github.workspace }}/demo-repo-go-binary'
29+
#
30+
# - name: Upload artifact
31+
# uses: actions/upload-artifact@v3
32+
# with:
33+
# name: demo-repo-python-binary
34+
# path: demo-repo-python-binary

‎.github/workflows/build-binary-unsigned.yml

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: binary-unsigned
2+
3+
on:
4+
workflow_dispatch:
5+
6+
jobs:
7+
build:
8+
permissions:
9+
id-token: write
10+
packages: write
11+
contents: write
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Check out code
15+
uses: actions/checkout@v4
16+
17+
# TODO: add that when we support artifacts other than containers
18+
#
19+
# - name: Build the binary
20+
# run: |
21+
# ...
22+
#
23+
# - name: Sign artifact
24+
# uses: actions/[email protected]
25+
# with:
26+
# subject-path: '${{ github.workspace }}/demo-repo-go-binary'
27+
#
28+
# - name: Upload artifact
29+
# uses: actions/upload-artifact@v3
30+
# with:
31+
# name: demo-repo-python-binary
32+
# path: demo-repo-python-binary

‎.github/workflows/build-image-signed-cosign-malicious.yml

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: image-signed-cosign(latest,daily)-malicious
2+
on:
3+
workflow_dispatch:
4+
5+
env:
6+
REGISTRY: ghcr.io
7+
IMAGE_NAME: ${{ github.repository }}
8+
9+
jobs:
10+
build:
11+
runs-on: ubuntu-latest
12+
permissions:
13+
contents: read
14+
packages: write
15+
id-token: write
16+
17+
steps:
18+
- name: Checkout repository
19+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
20+
21+
- name: The malicious step
22+
run: |
23+
echo "# This is a malicious update" >> app.py
24+
25+
- name: Install Cosign
26+
uses: sigstore/[email protected]
27+
28+
- name: Setup Docker buildx
29+
uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf
30+
31+
- name: Log into registry ${{ env.REGISTRY }}
32+
uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
33+
with:
34+
registry: ${{ env.REGISTRY }}
35+
username: ${{ github.actor }}
36+
password: ${{ secrets.GITHUB_TOKEN }}
37+
38+
- name: Extract Docker metadata
39+
id: meta
40+
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
41+
with:
42+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
43+
tags: |
44+
type=raw,value=latest
45+
type=raw,value=daily
46+
47+
- name: Build and push Docker image
48+
id: build-and-push
49+
uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
50+
with:
51+
context: .
52+
push: ${{ github.event_name != 'pull_request' }}
53+
tags: ${{ steps.meta.outputs.tags }}
54+
labels: ${{ steps.meta.outputs.labels }}
55+
cache-from: type=gha
56+
cache-to: type=gha,mode=max
57+
58+
- name: Sign the published Docker image
59+
env:
60+
TAGS: ${{ steps.meta.outputs.tags }}
61+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
62+
run: |
63+
cosign version
64+
echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎.github/workflows/build-image-signed-cosign-static-copied.yml

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: image-signed-cosign(static)-copied
2+
on:
3+
workflow_dispatch:
4+
5+
env:
6+
REGISTRY: ghcr.io
7+
IMAGE_NAME: ${{ github.repository }}
8+
9+
jobs:
10+
build:
11+
runs-on: ubuntu-latest
12+
permissions:
13+
contents: read
14+
packages: write
15+
id-token: write
16+
17+
steps:
18+
- name: Checkout repository
19+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
20+
21+
- name: Install Cosign
22+
uses: sigstore/[email protected]
23+
24+
- name: Setup Docker buildx
25+
uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf
26+
27+
- name: Log into registry ${{ env.REGISTRY }}
28+
uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
29+
with:
30+
registry: ${{ env.REGISTRY }}
31+
username: ${{ github.actor }}
32+
password: ${{ secrets.GITHUB_TOKEN }}
33+
34+
- name: Extract Docker metadata
35+
id: meta
36+
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
37+
with:
38+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
39+
tags: |
40+
type=raw,value=static
41+
42+
- name: Build and push Docker image
43+
id: build-and-push
44+
uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
45+
with:
46+
push: true
47+
tags: ${{ steps.meta.outputs.tags }}
48+
context: .
49+
file: Dockerfile.static
50+
51+
- name: Sign the published Docker image
52+
env:
53+
TAGS: ${{ steps.meta.outputs.tags }}
54+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
55+
run: |
56+
cosign version
57+
echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎.github/workflows/build-image-signed-cosign-static.yml

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: image-signed-cosign(static)
2+
on:
3+
workflow_dispatch:
4+
5+
env:
6+
REGISTRY: ghcr.io
7+
IMAGE_NAME: ${{ github.repository }}
8+
9+
jobs:
10+
build:
11+
runs-on: ubuntu-latest
12+
permissions:
13+
contents: read
14+
packages: write
15+
id-token: write
16+
17+
steps:
18+
- name: Checkout repository
19+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
20+
21+
- name: Install Cosign
22+
uses: sigstore/[email protected]
23+
24+
- name: Setup Docker buildx
25+
uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf
26+
27+
- name: Log into registry ${{ env.REGISTRY }}
28+
uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
29+
with:
30+
registry: ${{ env.REGISTRY }}
31+
username: ${{ github.actor }}
32+
password: ${{ secrets.GITHUB_TOKEN }}
33+
34+
- name: Extract Docker metadata
35+
id: meta
36+
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
37+
with:
38+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
39+
tags: |
40+
type=raw,value=static
41+
42+
- name: Build and push Docker image
43+
id: build-and-push
44+
uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
45+
with:
46+
push: true
47+
tags: ${{ steps.meta.outputs.tags }}
48+
context: .
49+
file: Dockerfile.static
50+
51+
- name: Sign the published Docker image
52+
env:
53+
TAGS: ${{ steps.meta.outputs.tags }}
54+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
55+
run: |
56+
cosign version
57+
echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎.github/workflows/build-image-signed-cosign.yml

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: image-signed-cosign(latest,daily)
2+
on:
3+
workflow_dispatch:
4+
5+
env:
6+
REGISTRY: ghcr.io
7+
IMAGE_NAME: ${{ github.repository }}
8+
9+
jobs:
10+
build:
11+
runs-on: ubuntu-latest
12+
permissions:
13+
contents: read
14+
packages: write
15+
id-token: write
16+
17+
steps:
18+
- name: Checkout repository
19+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
20+
21+
- name: Install Cosign
22+
uses: sigstore/[email protected]
23+
24+
- name: Setup Docker buildx
25+
uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf
26+
27+
- name: Log into registry ${{ env.REGISTRY }}
28+
uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c
29+
with:
30+
registry: ${{ env.REGISTRY }}
31+
username: ${{ github.actor }}
32+
password: ${{ secrets.GITHUB_TOKEN }}
33+
34+
- name: Extract Docker metadata
35+
id: meta
36+
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
37+
with:
38+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
39+
tags: |
40+
type=raw,value=latest
41+
type=raw,value=daily
42+
43+
- name: Build and push Docker image
44+
id: build-and-push
45+
uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
46+
with:
47+
context: .
48+
push: ${{ github.event_name != 'pull_request' }}
49+
tags: ${{ steps.meta.outputs.tags }}
50+
labels: ${{ steps.meta.outputs.labels }}
51+
cache-from: type=gha
52+
cache-to: type=gha,mode=max
53+
54+
- name: Sign the published Docker image
55+
env:
56+
TAGS: ${{ steps.meta.outputs.tags }}
57+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
58+
run: |
59+
cosign version
60+
echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

0 commit comments

Comments
 (0)