mirror of
https://github.com/fluxcd/flagger.git
synced 2026-04-15 06:57:34 +00:00
Stefan Prodan
300cd24493
- Replace the Cosign static key with GitHub Actions OIDC when signing the flagger container image - Sign the GitHub release assets checksums with Cosign keyless - Sign the load-tester container image with Cosign keyless Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
31 lines
561 B
YAML
31 lines
561 B
YAML
project_name: flagger
|
|
|
|
builds:
|
|
- skip: true
|
|
|
|
release:
|
|
prerelease: auto
|
|
|
|
source:
|
|
enabled: true
|
|
name_template: "{{ .ProjectName }}_{{ .Version }}_source_code"
|
|
|
|
sboms:
|
|
- id: source
|
|
artifacts: source
|
|
documents:
|
|
- "{{ .ProjectName }}_{{ .Version }}_sbom.spdx.json"
|
|
|
|
signs:
|
|
- cmd: cosign
|
|
env:
|
|
- COSIGN_EXPERIMENTAL=1
|
|
certificate: '${artifact}.pem'
|
|
args:
|
|
- sign-blob
|
|
- '--output-certificate=${certificate}'
|
|
- '--output-signature=${signature}'
|
|
- '${artifact}'
|
|
artifacts: checksum
|
|
output: true
|