ynkmr/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-09-08 22:13:26 +09:00
Code Issues Projects Releases Wiki Activity

build(sign): move to sigstore (#38250)

Browse Source 
drops signing with gpg in favor of sigstore based artifact signing
This commit is contained in:
TheFox0x7
2026-06-28 19:18:12 +00:00
committed by GitHub
parent cc1df1976b
commit 98c61942aa
3 changed files with 12 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release-nightly.yml
+4 -10
View File
@@ -13,6 +13,7 @@ jobs:
runs-on: namespace-profile-gitea-release-binary runs-on: namespace-profile-gitea-release-binary
permissions: permissions:
contents: read contents: read
id-token: write
steps: steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
# fetch all commits instead of only the last as some branches are long lived and could have many between versions # fetch all commits instead of only the last as some branches are long lived and could have many between versions
@@ -33,19 +34,12 @@ jobs:
- run: make release - run: make release
env: env:
TAGS: bindata TAGS: bindata
- name: import gpg key - name: Install Cosign
id: import_gpg uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
with:
gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
- name: sign binaries - name: sign binaries
env:
GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
run: | run: |
for f in dist/release/*; do for f in dist/release/*; do
echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f" cosign sign-blob "$f" --bundle "$f.sigstore.json" --yes
done done
# clean branch name to get the folder name in S3 # clean branch name to get the folder name in S3
- name: Get cleaned branch name - name: Get cleaned branch name
.github/workflows/release-tag-rc.yml
+4 -10
View File
@@ -14,6 +14,7 @@ jobs:
runs-on: namespace-profile-gitea-release-binary runs-on: namespace-profile-gitea-release-binary
permissions: permissions:
contents: read contents: read
id-token: write
steps: steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
# fetch all commits instead of only the last as some branches are long lived and could have many between versions # fetch all commits instead of only the last as some branches are long lived and could have many between versions
@@ -34,19 +35,12 @@ jobs:
- run: make release - run: make release
env: env:
TAGS: bindata TAGS: bindata
- name: import gpg key - name: Install Cosign
id: import_gpg uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
with:
gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
- name: sign binaries - name: sign binaries
env:
GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
run: | run: |
for f in dist/release/*; do for f in dist/release/*; do
echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f" cosign sign-blob "$f" --bundle "$f.sigstore.json" --yes
done done
# clean branch name to get the folder name in S3 # clean branch name to get the folder name in S3
- name: Get cleaned branch name - name: Get cleaned branch name
.github/workflows/release-tag-version.yml
+4 -10
View File
@@ -17,6 +17,7 @@ jobs:
permissions: permissions:
contents: read contents: read
packages: write # to publish to ghcr.io packages: write # to publish to ghcr.io
id-token: write
steps: steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
# fetch all commits instead of only the last as some branches are long lived and could have many between versions # fetch all commits instead of only the last as some branches are long lived and could have many between versions
@@ -37,19 +38,12 @@ jobs:
- run: make release - run: make release
env: env:
TAGS: bindata TAGS: bindata
- name: import gpg key - name: Install Cosign
id: import_gpg uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
with:
gpg_private_key: ${{ secrets.GPGSIGN_KEY }}
passphrase: ${{ secrets.GPGSIGN_PASSPHRASE }}
- name: sign binaries - name: sign binaries
env:
GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
GPG_PASSPHRASE: ${{ secrets.GPGSIGN_PASSPHRASE }}
run: | run: |
for f in dist/release/*; do for f in dist/release/*; do
echo "$GPG_PASSPHRASE" | gpg --pinentry-mode loopback --passphrase-fd 0 --batch --yes --detach-sign -u "$GPG_FINGERPRINT" --output "$f.asc" "$f" cosign sign-blob "$f" --bundle "$f.sigstore.json" --yes
done done
# clean branch name to get the folder name in S3 # clean branch name to get the folder name in S3
- name: Get cleaned branch name - name: Get cleaned branch name