Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2024-10-01 01:36:09 -04:00
Code Issues Packages Projects Releases Wiki Activity

ci: specify URL predicate because shortnames are unreliable

Browse Source
This commit is contained in:
Nils Hanke 2023-02-22 15:06:30 +01:00 committed by Nils Hanke
parent 3c24fa37e8
commit 9b1c9f971f
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
.github/actions/container_sbom/action.yml vendored
View File

@ -34,9 +34,9 @@ runs:
run: | run: |
set -ex set -ex
syft packages ${{ inputs.containerReference }} -o cyclonedx-json > container-image-predicate.json syft packages ${{ inputs.containerReference }} -o cyclonedx-json > container-image-predicate.json
cosign attest ${{ inputs.containerReference }} --key env://COSIGN_PRIVATE_KEY --predicate container-image-predicate.json --type cyclonedx > container-image.att.json cosign attest ${{ inputs.containerReference }} --key env://COSIGN_PRIVATE_KEY --predicate container-image-predicate.json --type "https://cyclonedx.org/bom" > container-image.att.json
cosign attach attestation ${{ inputs.containerReference }} --attestation container-image.att.json cosign attach attestation ${{ inputs.containerReference }} --attestation container-image.att.json
# TODO: type should be auto-discovered after issue is resolved: # TODO: type should be auto-discovered after issue is resolved:
# https://github.com/sigstore/cosign/issues/2264 # https://github.com/sigstore/cosign/issues/2264
cosign verify-attestation ${{ inputs.containerReference }} --type 'https://cyclonedx.org/bom' --key env://COSIGN_PUBLIC_KEY cosign verify-attestation ${{ inputs.containerReference }} --type "https://cyclonedx.org/bom" --key env://COSIGN_PUBLIC_KEY
grype ${{ inputs.containerReference }} --fail-on high --only-fixed --add-cpes-if-none grype ${{ inputs.containerReference }} --fail-on high --only-fixed --add-cpes-if-none