github/wonderwall
1
0
Fork 0
mirror of https://github.com/nais/wonderwall.git synced 2026-08-23 21:16:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

use verified distroless images

Browse Source
This commit is contained in:
J-K. Solbakken
2023-04-13 15:09:11 +02:00
parent 9eeb6f5e96
commit 890159c166
2 changed files with 10 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/deploy.yml
+8 -4
View File
@@ -28,6 +28,14 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # ratchet:actions/checkout@v3
- name: Install cosign
uses: sigstore/cosign-installer@9e9de2292db7abb3f51b7f4808d98f0d347a8919 # ratchet:sigstore/cosign-installer@main
with:
cosign-release: 'v2.0.0'
- name: Verify builder image
run: cosign verify --certificate-identity "https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main" --certificate-oidc-issuer "https://token.actions.githubusercontent.com" cgr.dev/chainguard/go:1.20
- name: Verify runner image
run: cosign verify --certificate-oidc-issuer https://accounts.google.com --certificate-identity keyless@distroless.iam.gserviceaccount.com gcr.io/distroless/static-debian11:nonroot
- id: "auth"
name: "Authenticate to Google Cloud"
uses: "google-github-actions/auth@ef5d53e30bbcd8d0836f4288f5e50ff3e086997d" # ratchet:google-github-actions/auth@v1
@@ -83,10 +91,6 @@ jobs:
labels: ${{ steps.metadata.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
- name: Install cosign
uses: sigstore/cosign-installer@9e9de2292db7abb3f51b7f4808d98f0d347a8919 # ratchet:sigstore/cosign-installer@main
with:
cosign-release: 'v2.0.0'
- name: Sign the container image for GAR
run: cosign sign --yes ${{ env.GOOGLE_REGISTRY }}/wonderwall@${{ steps.build-push.outputs.digest }}
- name: Create SBOM
Dockerfile
+2 -3
View File
@@ -1,5 +1,4 @@
FROM golang:1.20.3-alpine as builder
RUN apk add --no-cache git make curl
FROM cgr.dev/chainguard/go:1.20 as builder
ENV GOOS=linux
ENV CGO_ENABLED=0
COPY . /src
@@ -8,7 +7,7 @@ RUN make test
RUN make check
RUN make wonderwall
FROM gcr.io/distroless/static-debian11
FROM gcr.io/distroless/static-debian11:nonroot
WORKDIR /app
COPY --from=builder /src/bin/wonderwall /app/wonderwall
ENTRYPOINT ["/app/wonderwall"]