Changes in goreleaser (#3274)

* Changes in goreleaser Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * few more fixes Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * Test release Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * use setup-buildx action Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * Project name Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * changes in cosign Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * Fix image digest Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * Verify provenance Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * temp commit Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * few more changes Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * fix attestations write permission Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * Try pushing provenance to registry Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * Simplify provenance and sbom for images * Sign all artifacts * Change repo to fission Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * fix docker builds for skaffold Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * Fix sed commands Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> --------- Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
2025-12-14 17:43:22 +05:30
parent b7819fda76
commit eb865e137f
10 changed files with 131 additions and 334 deletions
@@ -25,6 +25,7 @@ env:
  HELM_VERSION: v3.19.0
  KIND_VERSION: v0.30.0
  KIND_CLUSTER_NAME: kind
+  SKAFFOLD_VERSION: v2.16.1

 permissions:
  contents: read
@@ -91,7 +92,7 @@ jobs:

      - name: Install Skaffold
        run: |
-          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.14.0/skaffold-linux-amd64
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/${{ env.SKAFFOLD_VERSION }}/skaffold-linux-amd64
          sudo install skaffold /usr/local/bin/
          skaffold version

@@ -239,7 +240,7 @@ jobs:

      - name: Install Skaffold
        run: |
-          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/v2.14.0/skaffold-linux-amd64
+          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/${{ env.SKAFFOLD_VERSION }}/skaffold-linux-amd64
          sudo install skaffold /usr/local/bin/
          skaffold version

@@ -15,13 +15,13 @@ jobs:
  create-draft-release:
    name: Create Draft Release with Goreleaser
    outputs:
-      hashes: ${{ steps.binary.outputs.hashes }}
      ghcr_images: ${{ steps.image.outputs.ghcr_images }}
      version: ${{ steps.get_version.outputs.VERSION }}
    permissions:
      contents: write # for goreleaser/goreleaser-action to create a GitHub release
      packages: write # for goreleaser/goreleaser-action to upload artifacts to GitHub Packages
      id-token: write # for cosign to sign the image and binary
+      attestations: write # for goreleaser/goreleaser-action to upload attestations
    runs-on: ubuntu-24.04
    steps:
      - name: Harden Runner
@@ -61,6 +61,9 @@ jobs:
      - name: Set up QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+
      - name: Login to ghcr.io
        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
@@ -95,15 +98,12 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          DOCKER_CLI_EXPERIMENTAL: "enabled"

-      - name: Generate binary hashes
-        id: binary
-        env:
-          ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}"
-        run: |
-          set -euo pipefail
-
-          checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
-          echo "hashes=$(cat $checksum_file | base64 -w0)" >> "$GITHUB_OUTPUT"
+      # Attest binary artifacts
+      # https://goreleaser.com/customization/attestations/
+      - name: Attest binary artifacts
+        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+        with:
+          subject-checksums: ./dist/checksums.txt

      - name: Image digest
        id: image
@@ -111,7 +111,7 @@ jobs:
          ARTIFACTS: "${{ steps.goreleaser.outputs.artifacts }}"
        run: |
          set -euo pipefail
-          image_and_digest=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Docker Manifest") | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {name} + {digest} | join("@") | sub("^sha256:";"")' | grep -v latest)
+          image_and_digest=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Docker Image") | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {name} + {digest} | join("@") | sub("^sha256:";"")' | grep -v latest)
          ghcr_images=$(echo "${image_and_digest}" | grep ghcr.io | jq -R -s -c '
            split("\n")
            | map(select(. != ""))
@@ -124,40 +124,8 @@ jobs:
              )')
          echo "ghcr_images=$ghcr_images" >> "$GITHUB_OUTPUT"

-  binary-provenance:
-    name: Create Binary Provenance
-    needs: [create-draft-release]
-    permissions:
-      actions: read # To read the workflow path.
-      id-token: write # To sign the provenance.
-      contents: write # To add assets to a release.
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0  # Do not use commit hash
-    with:
-      base64-subjects: "${{ needs.create-draft-release.outputs.hashes }}"
-      provenance-name: "fission_${{ needs.create-draft-release.outputs.version }}.intoto.jsonl"
-      upload-assets: true # upload to a new release
-      draft-release: true # create a draft release
-
-  image-provenance-ghcr:
-    name: Create Image Provenance
-    needs: [create-draft-release]
-    strategy:
-      matrix:
-        include: ${{ fromJson(needs.create-draft-release.outputs.ghcr_images) }}
-    permissions:
-      actions: read
-      id-token: write
-      packages: write
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0 # Do not use commit hash
-    with:
-      image: ${{ fromJson(toJson(matrix)).image }}
-      digest: ${{ fromJson(toJson(matrix)).checksum }}
-      registry-username: ${{ github.actor }}
-    secrets:
-      registry-password: ${{ secrets.GITHUB_TOKEN }}
-
-  image-sbom-ghcr:
-    name: Create SBOM for container images
+  image-sbom-provenance-ghcr:
+    name: Create SBOM & Provenance for container images
    # Goreleaser does not support generating SBOM for container images.
    needs: [create-draft-release]
    runs-on: ubuntu-24.04
@@ -168,6 +136,7 @@ jobs:
      actions: write
      id-token: write
      packages: write
+      attestations: write
    steps:
      - name: Checkout code
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
@@ -184,66 +153,24 @@ jobs:
        with:
          scan-type: "fs"
          format: "spdx-json"
-          output: "spdx.sbom.json"
-      - name: Install Cosign
-        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+          output: "sbom.spdx.json"
+      - name: Attest SBOM for image
+        uses: actions/attest-sbom@4651f806c01d8637787e274ac3bdf724ef169f34 # v3.0.0
        with:
-          cosign-release: ${{ env.COSIGN_VERSION }}
-      - name: Sign image and sbom
-        env:
-          IMAGE: ${{ fromJson(toJson(matrix)).image }}
-          DIGEST: ${{ fromJson(toJson(matrix)).checksum }}
-        run: |
-          #!/usr/bin/env bash
-          set -euo pipefail
-          cosign attach sbom --sbom spdx.sbom.json $IMAGE@$DIGEST
-          cosign sign -a git_sha=$GITHUB_SHA --attachment sbom $IMAGE@$DIGEST --yes
-
-  binary-provenance-verification-with-slsa-verifier:
-    name : Verify Binary Provenance
-    needs: [create-draft-release, binary-provenance]
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: write # To download the assets from draft release.
-    steps:
-      - name: Install the verifier
-        uses: slsa-framework/slsa-verifier/actions/installer@ea584f4502babc6f60d9bc799dbbb13c1caa9ee6 # v2.7.1
-
-      - name: Download assets
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PROVENANCE: ${{ needs.binary-provenance.outputs.provenance-name }}
-          VERSION: ${{ needs.create-draft-release.outputs.version }}
-        run: |
-          set -euo pipefail
-          echo "repo=$GITHUB_REPOSITORY"
-          echo "ref=$VERSION"
-          gh -R "$GITHUB_REPOSITORY" release download "$VERSION" -p "$PROVENANCE"
-
-      - name: Verify assets
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CHECKSUMS: ${{ needs.create-draft-release.outputs.hashes }}
-          PROVENANCE: ${{ needs.binary-provenance.outputs.provenance-name }}
-          VERSION: ${{ needs.create-draft-release.outputs.version }}
-        run: |
-          set -euo pipefail
-          echo "CHECKSUMS=$CHECKSUMS"
-          echo "PROVENANCE=$PROVENANCE"
-          checksums=$(echo "$CHECKSUMS" | base64 -d)
-          while read -r line; do
-              fn=$(echo $line | cut -d ' ' -f2)
-              echo "Verifying $fn"
-              gh -R "$GITHUB_REPOSITORY" release download "$VERSION" -p "$fn"
-              slsa-verifier verify-artifact --provenance-path "$PROVENANCE" \
-                                            --source-uri "github.com/$GITHUB_REPOSITORY" \
-                                            --source-tag "$VERSION" \
-                                            "$fn"
-          done <<<"$checksums"
+          sbom-path: sbom.spdx.json
+          subject-name: ${{ fromJson(toJson(matrix)).image }}
+          subject-digest: ${{ fromJson(toJson(matrix)).checksum }}
+          push-to-registry: true
+      - name: Attest provenance for image
+        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+        with:
+          subject-name: ${{ fromJson(toJson(matrix)).image }}
+          subject-digest: ${{ fromJson(toJson(matrix)).checksum }}
+          push-to-registry: true

  image-provenance-verification-with-cosign:
    name: Verify Image Provenance
-    needs: [create-draft-release, image-provenance-ghcr]
+    needs: [create-draft-release, image-sbom-provenance-ghcr]
    strategy:
      matrix:
        include: ${{ fromJson(needs.create-draft-release.outputs.ghcr_images) }}
@@ -269,7 +196,7 @@ jobs:
        run: |
          echo "Verifying $IMAGE@$DIGEST"
          cosign verify-attestation \
-             --type slsaprovenance \
+             --type https://slsa.dev/provenance/v1 \
             --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-             --certificate-identity-regexp '^https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v[0-9]+.[0-9]+.[0-9]+$' \
-             $IMAGE@$DIGEST
+             --certificate-identity-regexp '^https://github.com/fission/fission/.github/workflows/release.yaml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+(?:-rc[0-9]+)?$' \
+             $IMAGE@$DIGEST