mirror of
https://github.com/kyverno/kyverno.git
synced 2024-12-15 17:51:20 +00:00
chore: add slsa provenance jobs to all images published (#6824)
Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>
This commit is contained in:
Charles-Edouard Brétéché
GitHub
parent
dfa8344eb4
commit
512e481119
1 changed files with 117 additions and 14 deletions
131
.github/workflows/images-publish.yaml
vendored
131
.github/workflows/images-publish.yaml
vendored
|
|
@ -18,6 +18,13 @@ permissions:
|
|||
jobs:
|
||||
publish-images:
|
||||
runs-on: ubuntu-latest
|
||||
outputs:
|
||||
kyverno-digest: ${{ steps.publish-kyverno.outputs.digest }}
|
||||
kyverno-init-digest: ${{ steps.publish-kyverno-init.outputs.digest }}
|
||||
background-controller-digest: ${{ steps.publish-background-controller.outputs.digest }}
|
||||
cleanup-controller-digest: ${{ steps.publish-cleanup-controller.outputs.digest }}
|
||||
cli-digest: ${{ steps.publish-cli.outputs.digest }}
|
||||
reports-controller: ${{ steps.publish-reports-controller.outputs.digest }}
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
|
||||
|
|
@ -38,6 +45,7 @@ jobs:
|
|||
with:
|
||||
cosign-release: 'v1.13.0'
|
||||
- name: Publish kyverno
|
||||
id: publish-kyverno
|
||||
uses: ./.github/actions/publish-image
|
||||
with:
|
||||
makefile-target: ko-publish-kyverno
|
||||
|
|
@ -52,6 +60,7 @@ jobs:
|
|||
signature-repository: ghcr.io/${{ github.repository_owner }}/signatures
|
||||
main-path: ./cmd/kyverno
|
||||
- name: Publish kyverno-init
|
||||
id: publish-kyverno-init
|
||||
uses: ./.github/actions/publish-image
|
||||
with:
|
||||
makefile-target: ko-publish-kyverno-init
|
||||
|
|
@ -65,7 +74,23 @@ jobs:
|
|||
sbom-repository: ghcr.io/${{ github.repository_owner }}/sbom
|
||||
signature-repository: ghcr.io/${{ github.repository_owner }}/signatures
|
||||
main-path: ./cmd/kyverno-init
|
||||
- name: Publish background-controller
|
||||
id: publish-background-controller
|
||||
uses: ./.github/actions/publish-image
|
||||
with:
|
||||
makefile-target: ko-publish-background-controller
|
||||
registry: ghcr.io
|
||||
registry-username: ${{ github.actor }}
|
||||
registry-password: ${{ secrets.CR_PAT }}
|
||||
repository: ${{ github.repository_owner }}
|
||||
version: ${{ github.ref_name }}
|
||||
sign-image: true
|
||||
sbom-name: background-controller
|
||||
sbom-repository: ghcr.io/${{ github.repository_owner }}/sbom
|
||||
signature-repository: ghcr.io/${{ github.repository_owner }}/signatures
|
||||
main-path: ./cmd/background-controller
|
||||
- name: Publish cleanup-controller
|
||||
id: publish-cleanup-controller
|
||||
uses: ./.github/actions/publish-image
|
||||
with:
|
||||
makefile-target: ko-publish-cleanup-controller
|
||||
|
|
@ -80,6 +105,7 @@ jobs:
|
|||
signature-repository: ghcr.io/${{ github.repository_owner }}/signatures
|
||||
main-path: ./cmd/cleanup-controller
|
||||
- name: Publish cli
|
||||
id: publish-cli
|
||||
uses: ./.github/actions/publish-image
|
||||
with:
|
||||
makefile-target: ko-publish-cli
|
||||
|
|
@ -94,6 +120,7 @@ jobs:
|
|||
signature-repository: ghcr.io/${{ github.repository_owner }}/signatures
|
||||
main-path: ./cmd/cli/kubectl-kyverno
|
||||
- name: Publish reports-controller
|
||||
id: publish-reports-controller
|
||||
uses: ./.github/actions/publish-image
|
||||
with:
|
||||
makefile-target: ko-publish-reports-controller
|
||||
|
|
@ -107,17 +134,93 @@ jobs:
|
|||
sbom-repository: ghcr.io/${{ github.repository_owner }}/sbom
|
||||
signature-repository: ghcr.io/${{ github.repository_owner }}/signatures
|
||||
main-path: ./cmd/reports-controller
|
||||
- name: Publish background-controller
|
||||
uses: ./.github/actions/publish-image
|
||||
with:
|
||||
makefile-target: ko-publish-background-controller
|
||||
registry: ghcr.io
|
||||
registry-username: ${{ github.actor }}
|
||||
registry-password: ${{ secrets.CR_PAT }}
|
||||
repository: ${{ github.repository_owner }}
|
||||
version: ${{ github.ref_name }}
|
||||
sign-image: true
|
||||
sbom-name: background-controller
|
||||
sbom-repository: ghcr.io/${{ github.repository_owner }}/sbom
|
||||
signature-repository: ghcr.io/${{ github.repository_owner }}/signatures
|
||||
main-path: ./cmd/background-controller
|
||||
|
||||
generate-kyverno-provenance:
|
||||
needs: publish-images
|
||||
permissions:
|
||||
id-token: write # To sign the provenance.
|
||||
packages: write # To upload assets to release.
|
||||
actions: read # To read the workflow path.
|
||||
# NOTE: The container generator workflow is not officially released as GA.
|
||||
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.5.0
|
||||
with:
|
||||
image: ghcr.io/${{ github.repository_owner }}/kyverno
|
||||
digest: "${{ needs.publish-images.outputs.kyverno-digest }}"
|
||||
registry-username: ${{ github.actor }}
|
||||
secrets:
|
||||
registry-password: ${{ secrets.CR_PAT }}
|
||||
|
||||
generate-kyverno-init-provenance:
|
||||
needs: publish-images
|
||||
permissions:
|
||||
id-token: write # To sign the provenance.
|
||||
packages: write # To upload assets to release.
|
||||
actions: read # To read the workflow path.
|
||||
# NOTE: The container generator workflow is not officially released as GA.
|
||||
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.5.0
|
||||
with:
|
||||
image: ghcr.io/${{ github.repository_owner }}/kyvernopre
|
||||
digest: "${{ needs.publish-images.outputs.kyverno-init-digest }}"
|
||||
registry-username: ${{ github.actor }}
|
||||
secrets:
|
||||
registry-password: ${{ secrets.CR_PAT }}
|
||||
|
||||
generate-background-controller-provenance:
|
||||
needs: publish-images
|
||||
permissions:
|
||||
id-token: write # To sign the provenance.
|
||||
packages: write # To upload assets to release.
|
||||
actions: read # To read the workflow path.
|
||||
# NOTE: The container generator workflow is not officially released as GA.
|
||||
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.5.0
|
||||
with:
|
||||
image: ghcr.io/${{ github.repository_owner }}/background-controller
|
||||
digest: "${{ needs.publish-images.outputs.background-controller-digest }}"
|
||||
registry-username: ${{ github.actor }}
|
||||
secrets:
|
||||
registry-password: ${{ secrets.CR_PAT }}
|
||||
|
||||
generate-cleanup-controller-provenance:
|
||||
needs: publish-images
|
||||
permissions:
|
||||
id-token: write # To sign the provenance.
|
||||
packages: write # To upload assets to release.
|
||||
actions: read # To read the workflow path.
|
||||
# NOTE: The container generator workflow is not officially released as GA.
|
||||
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.5.0
|
||||
with:
|
||||
image: ghcr.io/${{ github.repository_owner }}/cleanup-controller
|
||||
digest: "${{ needs.publish-images.outputs.cleanup-controller-digest }}"
|
||||
registry-username: ${{ github.actor }}
|
||||
secrets:
|
||||
registry-password: ${{ secrets.CR_PAT }}
|
||||
|
||||
generate-kyverno-cli-provenance:
|
||||
needs: publish-images
|
||||
permissions:
|
||||
id-token: write # To sign the provenance.
|
||||
packages: write # To upload assets to release.
|
||||
actions: read # To read the workflow path.
|
||||
# NOTE: The container generator workflow is not officially released as GA.
|
||||
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.5.0
|
||||
with:
|
||||
image: ghcr.io/${{ github.repository_owner }}/kyverno-cli
|
||||
digest: "${{ needs.publish-images.outputs.cli-digest }}"
|
||||
registry-username: ${{ github.actor }}
|
||||
secrets:
|
||||
registry-password: ${{ secrets.CR_PAT }}
|
||||
|
||||
generate-reports-controller-provenance:
|
||||
needs: publish-images
|
||||
permissions:
|
||||
id-token: write # To sign the provenance.
|
||||
packages: write # To upload assets to release.
|
||||
actions: read # To read the workflow path.
|
||||
# NOTE: The container generator workflow is not officially released as GA.
|
||||
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.5.0
|
||||
with:
|
||||
image: ghcr.io/${{ github.repository_owner }}/reports-controller
|
||||
digest: "${{ needs.publish-images.outputs.reports-controller-digest }}"
|
||||
registry-username: ${{ github.actor }}
|
||||
secrets:
|
||||
registry-password: ${{ secrets.CR_PAT }}
|
||||
|
|
|
|||
Loading…
Reference in a new issue