Start keyless signing kaniko releases
@@ -7,6 +7,12 @@ on:
jobs:
build-executor:
+ permissions:
+ # Read the repo contents
+ contents: read
+ # Produce identity token for keyless signing
+ id-token: write
+
env:
GITHUB_SHA: ${{ github.sha }}
GITHUB_REF: ${{ github.ref }}
@@ -71,11 +77,20 @@ jobs:
cosign-release: 'v1.4.1'
# Use cosign to sign the images
- - run: |
+ - env:
+ COSIGN_EXPERIMENTAL: "true"
+ run: |
export KMS_VAL=gcpkms://projects/kaniko-project/locations/global/keyRings/cosign/cryptoKeys/cosign
cosign sign -kms $KMS_VAL gcr.io/kaniko-project/executor@${{ steps.build-and-push.outputs.digest }}
+ cosign sign gcr.io/kaniko-project/executor@${{ steps.build-and-push.outputs.digest }}
build-debug:
+ permissions:
+ # Read the repo contents
+ contents: read
+ # Produce identity token for keyless signing
+ id-token: write
+
env:
GITHUB_SHA: ${{ github.sha }}
GITHUB_REF: ${{ github.ref }}
@@ -140,11 +155,20 @@ jobs:
cosign-release: 'v1.4.1'
# Use cosign to sign the images
- - run: |
+ - env:
+ COSIGN_EXPERIMENTAL: "true"
+ run: |
export KMS_VAL=gcpkms://projects/kaniko-project/locations/global/keyRings/cosign/cryptoKeys/cosign
cosign sign -kms $KMS_VAL gcr.io/kaniko-project/executor@${{ steps.build-and-push.outputs.digest }}
+ cosign sign gcr.io/kaniko-project/executor@${{ steps.build-and-push.outputs.digest }}
build-warmer:
+ permissions:
+ # Read the repo contents
+ contents: read
+ # Produce identity token for keyless signing
+ id-token: write
+
env:
GITHUB_SHA: ${{ github.sha }}
GITHUB_REF: ${{ github.ref }}
@@ -209,11 +233,20 @@ jobs:
cosign-release: 'v1.4.1'
# Use cosign to sign the images
- - run: |
+ - env:
+ COSIGN_EXPERIMENTAL: "true"
+ run: |
export KMS_VAL=gcpkms://projects/kaniko-project/locations/global/keyRings/cosign/cryptoKeys/cosign
cosign sign -kms $KMS_VAL gcr.io/kaniko-project/warmer@${{ steps.build-and-push.outputs.digest }}
+ cosign sign gcr.io/kaniko-project/warmer@${{ steps.build-and-push.outputs.digest }}
build-slim:
+ permissions:
+ # Read the repo contents
+ contents: read
+ # Produce identity token for keyless signing
+ id-token: write
+
env:
GITHUB_SHA: ${{ github.sha }}
GITHUB_REF: ${{ github.ref }}
@@ -278,7 +311,9 @@ jobs:
cosign-release: 'v1.4.1'
# Use cosign to sign the images
- - run: |
+ - env:
+ COSIGN_EXPERIMENTAL: "true"
+ run: |
export KMS_VAL=gcpkms://projects/kaniko-project/locations/global/keyRings/cosign/cryptoKeys/cosign
cosign sign -kms $KMS_VAL gcr.io/kaniko-project/executor@${{ steps.build-and-push.outputs.digest }}
-
+ cosign sign gcr.io/kaniko-project/executor@${{ steps.build-and-push.outputs.digest }}
