squakez commented on code in PR #6777:
URL: https://github.com/apache/camel-k/pull/6777#discussion_r3863397991
##########
.github/actions/release-nightly/action.yml:
##########
@@ -110,30 +111,70 @@ runs:
run: |
NOTEST=1 make VERSION=${{ env.VERSION }} IMAGE_NAME=${{ env.IMAGE_NAME
}} BUNDLE_IMAGE_NAME=docker.io/testcamelk/camel-k-bundle bundle-push
- - name: Install SBOM generator
+ - name: Install assurance tools
shell: bash
+ env:
+ CYCLONEDX_GOMOD_VERSION: v1.12.0
+ SYFT_VERSION: v1.51.0
+ COSIGN_VERSION: v3.1.3
run: |
- go install
github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
- echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
-
- - name: Generate SBOM
+ go install
github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@${CYCLONEDX_GOMOD_VERSION}
+ go install github.com/anchore/syft/cmd/syft@${SYFT_VERSION}
+ go install github.com/sigstore/cosign/v3/cmd/cosign@${COSIGN_VERSION}
+ echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
+ go version -m "$(go env GOPATH)/bin/cyclonedx-gomod" | grep -F
"github.com/CycloneDX/cyclonedx-gomod ${CYCLONEDX_GOMOD_VERSION}"
+ "$(go env GOPATH)/bin/syft" --version | grep -E '1\.51\.0$'
+ go version -m "$(go env GOPATH)/bin/cosign" | grep -F
"github.com/sigstore/cosign/v3 ${COSIGN_VERSION}"
+
+ - name: Generate module SBOM
shell: bash
- run: cyclonedx-gomod mod -licenses -json -output sbom.json
+ run: cyclonedx-gomod mod -licenses -json -noserial -notimestamp -output
sbom.json
- - name: Commit and push nightly branch
+ - name: Prepare nightly release commit
shell: bash
env:
CI_USER: "github-actions[bot]"
CI_EMAIL: "41898282+github-actions[bot]@users.noreply.github.com"
- CI_TOKEN: ${{ inputs.secretGithubToken }}
run: |
git config --local user.email "$CI_EMAIL"
git config --local user.name "$CI_USER"
git add docs/charts/
git commit -am 'chore(ci): ${{ env.TAG }} release updates' || echo "No
nightly release updates changes to commit"
echo "COMMIT_ID=$(git rev-parse HEAD)" >> $GITHUB_ENV
- git tag ${{ env.TAG }} $(git rev-parse HEAD)
- git push
"https://$CI_USER:[email protected]/$GITHUB_REPOSITORY.git"; tag ${{ env.TAG
}} -f || echo "No nightly release updates changes to push"
+
+ - name: Generate release assurance
+ shell: bash
+ env:
+ CYCLONEDX_GOMOD_VERSION: v1.12.0
+ SYFT_VERSION: v1.51.0
Review Comment:
could we instead have a unique place where to declare those versions? and
even better, we should pin to a given commit for security reason.
##########
.github/workflows/nightly-release.yml:
##########
@@ -30,6 +30,7 @@ env:
permissions:
contents: write
+ id-token: write
Review Comment:
Why is this needed?
##########
.github/actions/release-nightly/action.yml:
##########
@@ -110,30 +111,70 @@ runs:
run: |
NOTEST=1 make VERSION=${{ env.VERSION }} IMAGE_NAME=${{ env.IMAGE_NAME
}} BUNDLE_IMAGE_NAME=docker.io/testcamelk/camel-k-bundle bundle-push
- - name: Install SBOM generator
+ - name: Install assurance tools
shell: bash
+ env:
+ CYCLONEDX_GOMOD_VERSION: v1.12.0
+ SYFT_VERSION: v1.51.0
+ COSIGN_VERSION: v3.1.3
run: |
- go install
github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
- echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
-
- - name: Generate SBOM
+ go install
github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@${CYCLONEDX_GOMOD_VERSION}
+ go install github.com/anchore/syft/cmd/syft@${SYFT_VERSION}
+ go install github.com/sigstore/cosign/v3/cmd/cosign@${COSIGN_VERSION}
+ echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
+ go version -m "$(go env GOPATH)/bin/cyclonedx-gomod" | grep -F
"github.com/CycloneDX/cyclonedx-gomod ${CYCLONEDX_GOMOD_VERSION}"
+ "$(go env GOPATH)/bin/syft" --version | grep -E '1\.51\.0$'
+ go version -m "$(go env GOPATH)/bin/cosign" | grep -F
"github.com/sigstore/cosign/v3 ${COSIGN_VERSION}"
+
+ - name: Generate module SBOM
shell: bash
- run: cyclonedx-gomod mod -licenses -json -output sbom.json
+ run: cyclonedx-gomod mod -licenses -json -noserial -notimestamp -output
sbom.json
- - name: Commit and push nightly branch
+ - name: Prepare nightly release commit
shell: bash
env:
CI_USER: "github-actions[bot]"
CI_EMAIL: "41898282+github-actions[bot]@users.noreply.github.com"
- CI_TOKEN: ${{ inputs.secretGithubToken }}
run: |
git config --local user.email "$CI_EMAIL"
git config --local user.name "$CI_USER"
git add docs/charts/
git commit -am 'chore(ci): ${{ env.TAG }} release updates' || echo "No
nightly release updates changes to commit"
echo "COMMIT_ID=$(git rev-parse HEAD)" >> $GITHUB_ENV
- git tag ${{ env.TAG }} $(git rev-parse HEAD)
- git push
"https://$CI_USER:[email protected]/$GITHUB_REPOSITORY.git"; tag ${{ env.TAG
}} -f || echo "No nightly release updates changes to push"
+
+ - name: Generate release assurance
+ shell: bash
+ env:
+ CYCLONEDX_GOMOD_VERSION: v1.12.0
+ SYFT_VERSION: v1.51.0
+ SYFT_CHECK_FOR_APP_UPDATE: "false"
+ SYFT_REGISTRY_AUTH_USERNAME: ${{ inputs.secretDockerHubUser }}
+ SYFT_REGISTRY_AUTH_PASSWORD: ${{ inputs.secretDockerHubPassword }}
Review Comment:
Do you really need to have these credentials? the images are public, so the
pull should not need access to them.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
