mirrors/external-secrets
1
0
Fork 0
mirror of https://github.com/external-secrets/external-secrets.git synced 2024-12-14 11:57:59 +00:00
Code Activity

fix: restrict the token permission update to the push chart step (#4128)

Browse source
This commit is contained in:
Gergely Brautigam 2024-11-20 11:19:00 +01:00 committed by GitHub
parent 44e462f510
commit dc7c2ab443
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
.github/workflows/helm.yml vendored
View file

@ -71,8 +71,6 @@ jobs:
permissions: permissions:
contents: write # for helm/chart-releaser-action to push chart release and create a release contents: write # for helm/chart-releaser-action to push chart release and create a release
packages: write # to push OCI chart package to GitHub Registry packages: write # to push OCI chart package to GitHub Registry
id-token: write # gives the action the ability to mint the OIDC token necessary to request a Sigstore signing certificate
attestations: write # this permission is necessary to persist the attestation
runs-on: ubuntu-latest runs-on: ubuntu-latest
if: | if: |
github.ref == 'refs/heads/main' || github.ref == 'refs/heads/main' ||
@ -130,6 +128,9 @@ jobs:
cosign-release: 'v2.4.1' cosign-release: 'v2.4.1'
- name: Push chart to GHCR - name: Push chart to GHCR
permissions:
id-token: write # gives the action the ability to mint the OIDC token necessary to request a Sigstore signing certificate
attestations: write # this permission is necessary to persist the attestation
id: push_chart id: push_chart
run: | run: |
shopt -s nullglob shopt -s nullglob
@ -140,11 +141,11 @@ jobs:
chart_name=$(helm show chart "${pkg}" | yq .name) chart_name=$(helm show chart "${pkg}" | yq .name)
# helm push fails when registry path contains Uppercase letters # helm push fails when registry path contains Uppercase letters
chart_registry="ghcr.io/${GITHUB_REPOSITORY_OWNER}/charts" chart_registry="ghcr.io/${GITHUB_REPOSITORY_OWNER}/charts"
helm_push_output=$(helm push "${pkg}" "oci://${chart_registry}" 2>&1) helm_push_output=$(helm push "${pkg}" "oci://${chart_registry}" 2>&1)
digest=$(echo "$helm_push_output" | grep -o 'sha256:[a-z0-9]*') digest=$(echo "$helm_push_output" | grep -o 'sha256:[a-z0-9]*')
echo "$helm_push_output" echo "$helm_push_output"
artifact_digest_uri="${chart_registry}/${chart_name}@${digest}" artifact_digest_uri="${chart_registry}/${chart_name}@${digest}"
cosign sign --yes "$artifact_digest_uri" cosign sign --yes "$artifact_digest_uri"
cosign verify "$artifact_digest_uri" \ cosign verify "$artifact_digest_uri" \