humocs-man/fluffy-pancake
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

.gitea/workflows/build.yml aktualisiert

Browse Source
This commit is contained in:
humocs-man
2026-07-11 14:00:04 +00:00
parent 8a7cf60dde
commit c516a3c037
1 changed files with 6 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/build.yml
+6 -10
View File
@@ -108,12 +108,7 @@ jobs:
if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false' if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
uses: sigstore/cosign-installer@v4.1.2 uses: sigstore/cosign-installer@v4.1.2
- name: Install Skopeo - name: Sign container image (Recursive Digest)
if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
run: |
sudo apt-get update && sudo apt-get install -y skopeo
- name: Sign container image (True Outer Digest)
if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false' if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
env: env:
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
@@ -126,18 +121,19 @@ jobs:
echo "Frage finalen Manifest-List-Digest via Skopeo-Container ab..." echo "Frage finalen Manifest-List-Digest via Skopeo-Container ab..."
OUTER_DIGEST=$(docker run --rm quay.io/skopeo/stable inspect --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" docker://${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:stable | jq -r .Digest) OUTER_DIGEST=$(docker run --rm quay.io/skopeo/stable inspect --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" docker://${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:stable | jq -r .Digest)
# 3. Die Referenz exklusiv über den äußeren Digest bauen # 3. Die Referenz über den äußeren Digest bauen
IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${OUTER_DIGEST}" IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${OUTER_DIGEST}"
echo "Signiere exklusiv via OCI-Manifest-List-Digest: ${IMAGE_REF}" echo "Signiere Manifest-List und alle Sub-Architekturen rekursiv via Digest: ${IMAGE_REF}"
# 4. Signatur auf Gitea pushen # 4. Signatur rekursiv auf Gitea pushen (ohne deprecated tlog-Flag)
cosign sign -y \ cosign sign -y \
--key env://COSIGN_PRIVATE_KEY \ --key env://COSIGN_PRIVATE_KEY \
--recursive \
--use-signing-config=false \ --use-signing-config=false \
--new-bundle-format=false \ --new-bundle-format=false \
--tlog-upload=false \
--registry-referrers-mode=legacy \ --registry-referrers-mode=legacy \
"${IMAGE_REF}" "${IMAGE_REF}"
- name: Post-Build Cleanup - name: Post-Build Cleanup
if: always() if: always()
run: | run: |