mirrors/kyverno
mirrors/kyverno
1
0
Fork 0
mirror of https://github.com/kyverno/kyverno.git synced 2025-03-31 03:45:17 +00:00
Code Activity

generate SLSA provenance on releases (#5735)

Browse source 
Signed-off-by: ShutingZhao <shuting@nirmata.com>

Signed-off-by: ShutingZhao <shuting@nirmata.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>
This commit is contained in:
shuting 2022-12-21 19:13:21 +08:00 • committed by GitHub
parent 18aeb26a1d
commit 4e29ebca86
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 45 additions and 45 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

45
.github/workflows/image.yaml vendored
View file

@ -44,48 +44,3 @@ jobs:
secrets:
registry_username: ${{ github.actor }}
registry_password: ${{ secrets.CR_PAT }}
generate-init-kyverno-provenance:
needs: push-init-kyverno
permissions:
id-token: write # To sign the provenance.
packages: write # To upload assets to release.
actions: read #To read the workflow path.
# NOTE: The container generator workflow is not officially released as GA.
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.4.0
with:
image: ghcr.io/${{ github.repository_owner }}/kyvernopre
digest: "${{ needs.push-init-kyverno.outputs.init-container-digest }}"
registry-username: ${{ github.actor }}
secrets:
registry-password: ${{ secrets.CR_PAT }}
generate-kyverno-provenance:
needs: push-kyverno
permissions:
id-token: write # To sign the provenance.
packages: write # To upload assets to release.
actions: read #To read the workflow path.
# NOTE: The container generator workflow is not officially released as GA.
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.4.0
with:
image: ghcr.io/${{ github.repository_owner }}/kyverno
digest: "${{ needs.push-kyverno.outputs.kyverno-digest }}"
registry-username: ${{ github.actor }}
secrets:
registry-password: ${{ secrets.CR_PAT }}
generate-kyverno-cli-provenance:
needs: push-kyverno-cli
permissions:
id-token: write # To sign the provenance.
packages: write # To upload assets to release.
actions: read #To read the workflow path.
# NOTE: The container generator workflow is not officially released as GA.
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.4.0
with:
image: ghcr.io/${{ github.repository_owner }}/kyverno-cli
digest: "${{ needs.push-kyverno-cli.outputs.cli-digest }}"
registry-username: ${{ github.actor }}
secrets:
registry-password: ${{ secrets.CR_PAT }}

45
.github/workflows/release.yaml vendored
View file

@ -50,6 +50,51 @@ jobs:
registry_username: ${{ github.actor }}
registry_password: ${{ secrets.CR_PAT }}
generate-init-kyverno-provenance:
needs: release-init-kyverno
permissions:
id-token: write # To sign the provenance.
packages: write # To upload assets to release.
actions: read #To read the workflow path.
# NOTE: The container generator workflow is not officially released as GA.
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.4.0
with:
image: ghcr.io/${{ github.repository_owner }}/kyvernopre
digest: "${{ needs.release-init-kyverno.outputs.init-container-digest }}"
registry-username: ${{ github.actor }}
secrets:
registry-password: ${{ secrets.CR_PAT }}
generate-kyverno-provenance:
needs: release-kyverno
permissions:
id-token: write # To sign the provenance.
packages: write # To upload assets to release.
actions: read #To read the workflow path.
# NOTE: The container generator workflow is not officially released as GA.
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.4.0
with:
image: ghcr.io/${{ github.repository_owner }}/kyverno
digest: "${{ needs.release-kyverno.outputs.kyverno-digest }}"
registry-username: ${{ github.actor }}
secrets:
registry-password: ${{ secrets.CR_PAT }}
generate-kyverno-cli-provenance:
needs: release-kyverno-cli
permissions:
id-token: write # To sign the provenance.
packages: write # To upload assets to release.
actions: read #To read the workflow path.
# NOTE: The container generator workflow is not officially released as GA.
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.4.0
with:
image: ghcr.io/${{ github.repository_owner }}/kyverno-cli
digest: "${{ needs.release-kyverno-cli.outputs.cli-digest }}"
registry-username: ${{ github.actor }}
secrets:
registry-password: ${{ secrets.CR_PAT }}
create-release:
runs-on: ubuntu-latest
needs: