9f6e6f7fb3
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
Signals CI & Image / signals-ci (push) Has been cancelled
Policy Lint & Smoke / policy-lint (push) Has been cancelled
Policy Simulation / policy-simulate (push) Has been cancelled
SDK Publish & Sign / sdk-publish (push) Has been cancelled
AOC Guard CI / aoc-guard (push) Has been cancelled
AOC Guard CI / aoc-verify (push) Has been cancelled
Concelier Attestation Tests / attestation-tests (push) Has been cancelled
devportal-offline / build-offline (push) Has been cancelled
51 lines
1.3 KiB
YAML
51 lines
1.3 KiB
YAML
name: Mirror Thin Bundle Sign & Verify
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: '0 6 * * *'
|
|
|
|
jobs:
|
|
mirror-sign:
|
|
runs-on: ubuntu-22.04
|
|
env:
|
|
MIRROR_SIGN_KEY_B64: ${{ secrets.MIRROR_SIGN_KEY_B64 }}
|
|
REQUIRE_PROD_SIGNING: 1
|
|
OCI: 1
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Setup .NET
|
|
uses: actions/setup-dotnet@v4
|
|
with:
|
|
dotnet-version: 10.0.100-rc.2.25502.107
|
|
include-prerelease: true
|
|
|
|
- name: Verify signing prerequisites
|
|
run: scripts/mirror/check_signing_prereqs.sh
|
|
|
|
- name: Run mirror signing
|
|
run: |
|
|
scripts/mirror/ci-sign.sh
|
|
|
|
- name: Verify signed bundle
|
|
run: |
|
|
scripts/mirror/verify_thin_bundle.py out/mirror/thin/mirror-thin-v1.tar.gz
|
|
|
|
- name: Upload signed artifacts
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: mirror-thin-v1-signed
|
|
path: |
|
|
out/mirror/thin/mirror-thin-v1.tar.gz
|
|
out/mirror/thin/mirror-thin-v1.manifest.json
|
|
out/mirror/thin/mirror-thin-v1.manifest.dsse.json
|
|
out/mirror/thin/tuf/
|
|
out/mirror/thin/oci/
|
|
out/mirror/thin/milestone.json
|
|
if-no-files-found: error
|
|
retention-days: 14
|