Skip to content

Commit cff3249

Browse files
openshift-pipelines-botwaveywaves
openshift-pipelines-bot
authored and
waveywaves
committed
[bot] Update main from tektoncd-catalog/git-clone to 66bd9af
$ git diff --stat 66bd9af.. https://github.com/tektoncd-catalog/git-clone/compare/66bd9aff1a094e65be9813f36f3c805eb639388f..
1 parent 7642c4e commit cff3249

File tree

2,740 files changed

+1004487
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

2,740 files changed

+1004487
-0
lines changed

‎head

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
66bd9aff1a094e65be9813f36f3c805eb639388f

‎upstream/.github/dependabot.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "gomod" # See documentation for possible values
4+
directory: "/git" # Location of package manifests
5+
schedule:
6+
interval: "daily"
7+
- package-ecosystem: "github-actions"
8+
directory: "/"
9+
schedule:
10+
interval: "daily"

‎upstream/.github/workflows/build.yaml

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Build
2+
3+
on:
4+
pull_request:
5+
branches: ['main']
6+
push:
7+
branches: [ main ]
8+
schedule:
9+
- cron: '0 0 * * *'
10+
11+
jobs:
12+
13+
build:
14+
defaults:
15+
run:
16+
working-directory: image/git-init
17+
18+
name: Build ${{ matrix.go-version }}
19+
runs-on: ubuntu-latest
20+
21+
steps:
22+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
23+
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
24+
with:
25+
go-version-file: "image/git-init/go.mod"
26+
cache-dependency-path: "image/git-init/go.sum"
27+
28+
# FIXME: figure out how to configure or use golangci-lint
29+
# - uses: golang/govulncheck-action@dd3ead030e4f2cf713062f7a3395191802364e13 # v1
30+
# with:
31+
# go-package: ./image/git-init/...
32+
# go-version-input: ${{ matrix.go-version }}
33+
34+
- run: |
35+
go build ./...
36+
go test -run=^$ ./...

‎upstream/.github/workflows/release.yaml

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
name: release
2+
3+
on:
4+
push:
5+
tags:
6+
- '*'
7+
# FIXME(vdemeester) Add commit + tag
8+
9+
jobs:
10+
goreleaser:
11+
outputs:
12+
hashes: ${{ steps.hash.outputs.hashes }}
13+
tag_name: ${{ steps.tag.outputs.tag_name }}
14+
15+
defaults:
16+
run:
17+
working-directory: image/git-init
18+
19+
permissions:
20+
packages: write
21+
id-token: write
22+
contents: write
23+
24+
runs-on: ubuntu-latest
25+
# defaults:
26+
# run:
27+
# working-directory: ./image/git-init
28+
steps:
29+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
30+
31+
- run: git fetch --prune --unshallow
32+
33+
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
34+
with:
35+
go-version-file: "image/git-init/go.mod"
36+
cache-dependency-path: "image/git-init/go.sum"
37+
38+
# This installs the current latest release.
39+
- uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9
40+
41+
- uses: imjasonh/setup-crane@31b88efe9de28ae0ffa220711af4b60be9435f6e # v0.4
42+
43+
- uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
44+
45+
- name: Set tag output
46+
id: tag
47+
run: echo "tag_name=${GITHUB_REF#refs/*/}" >> "$GITHUB_OUTPUT"
48+
49+
- uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
50+
id: run-goreleaser
51+
with:
52+
version: latest
53+
args: release --clean
54+
workdir: ./image/git-init
55+
env:
56+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
57+
58+
- name: sign ko-image
59+
run: |
60+
digest=$(crane digest "${REGISTRY}":"${GIT_TAG}")
61+
cosign sign --yes \
62+
-a GIT_HASH="${GIT_HASH}" \
63+
-a GIT_TAG="${GIT_TAG}" \
64+
-a RUN_ID="${RUN_ID}" \
65+
-a RUN_ATTEMPT="${RUN_ATTEMPT}" \
66+
"${REGISTRY}@${digest}"
67+
env:
68+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
69+
GIT_HASH: ${{ github.sha }}
70+
GIT_TAG: ${{ steps.tag.outputs.tag_name }}
71+
RUN_ATTEMPT: ${{ github.run_attempt }}
72+
RUN_ID: ${{ github.run_id }}
73+
REGISTRY: "ghcr.io/${{ github.repository }}"
74+
75+
- name: Generate subject
76+
id: hash
77+
env:
78+
ARTIFACTS: "${{ steps.run-goreleaser.outputs.artifacts }}"
79+
run: |
80+
set -euo pipefail
81+
82+
checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
83+
echo "hashes=$(cat $checksum_file | base64 -w0)" >> "$GITHUB_OUTPUT"
84+
85+
provenance:
86+
needs:
87+
- goreleaser
88+
89+
permissions:
90+
actions: read # To read the workflow path.
91+
id-token: write # To sign the provenance.
92+
contents: write # To add assets to a release.
93+
94+
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
95+
with:
96+
base64-subjects: "${{ needs.goreleaser.outputs.hashes }}"
97+
upload-assets: true
98+
upload-tag-name: "${{ needs.release.outputs.tag_name }}"
99+
100+
verification:
101+
needs:
102+
- goreleaser
103+
- provenance
104+
105+
runs-on: ubuntu-latest
106+
permissions: read-all
107+
108+
steps:
109+
# Note: this will be replaced with the GHA in the future.
110+
- name: Install the verifier
111+
env:
112+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
113+
run: |
114+
set -euo pipefail
115+
116+
gh -R slsa-framework/slsa-verifier release download v1.3.2 -p "slsa-verifier-linux-amd64"
117+
chmod ug+x slsa-verifier-linux-amd64
118+
# Note: see https://github.com/slsa-framework/slsa-verifier/blob/main/SHA256SUM.md
119+
COMPUTED_HASH=$(sha256sum slsa-verifier-linux-amd64 | cut -d ' ' -f1)
120+
EXPECTED_HASH="b1d6c9bbce6274e253f0be33158cacd7fb894c5ebd643f14a911bfe55574f4c0"
121+
if [[ "$EXPECTED_HASH" != "$COMPUTED_HASH" ]];then
122+
echo "error: expected $EXPECTED_HASH, computed $COMPUTED_HASH"
123+
exit 1
124+
fi
125+
126+
- name: Download assets
127+
env:
128+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
129+
PROVENANCE: "${{ needs.provenance.outputs.provenance-name }}"
130+
run: |
131+
set -euo pipefail
132+
133+
gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "*.tar.gz"
134+
gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "$PROVENANCE"
135+
136+
- name: Verify assets
137+
env:
138+
CHECKSUMS: ${{ needs.goreleaser.outputs.hashes }}
139+
PROVENANCE: "${{ needs.provenance.outputs.provenance-name }}"
140+
run: |
141+
set -euo pipefail
142+
143+
checksums=$(echo "$CHECKSUMS" | base64 -d)
144+
while read -r line; do
145+
fn=$(echo $line | cut -d ' ' -f2)
146+
147+
echo "Verifying $fn"
148+
./slsa-verifier-linux-amd64 -artifact-path "$fn" \
149+
-provenance "$PROVENANCE" \
150+
-source "github.com/$GITHUB_REPOSITORY" \
151+
-tag "$GITHUB_REF_NAME"
152+
153+
done <<<"$checksums"

0 commit comments

Comments
 (0)