From 328595b77d0a11a0b9f43d6c5f3b04ed4b0c9742 Mon Sep 17 00:00:00 2001 From: "Jorge O. Castro" Date: Mon, 24 Apr 2023 13:31:03 -0400 Subject: [PATCH] refactor: avoid subshell, sign image with env. var (#30) Works in main, propagating here. Co-authored-by: xnasero@posteo.net --- .github/workflows/build.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index ed01897..1c56459 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -58,7 +58,7 @@ jobs: COMMIT_TAGS=() BUILD_TAGS=() # Have tags for tracking builds during pull request - SHA_SHORT="$(git rev-parse --short HEAD)" + SHA_SHORT="${GITHUB_SHA::7}" COMMIT_TAGS+=("pr-${{ github.event.number }}-${MAJOR_VERSION}") COMMIT_TAGS+=("${SHA_SHORT}-${MAJOR_VERSION}") @@ -142,10 +142,10 @@ jobs: # Only needed when running `cosign sign` using a key - name: Write signing key to disk run: | - echo "${{ env.COSIGN_PRIVATE_KEY }}" > cosign.key - # DEBUG: get character count of key - wc -c cosign.key + cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ env.IMAGE_NAME }}@${TAGS} env: + TAGS: ${{ steps.push.outputs.digest }} + COSIGN_EXPERIMENTAL: false COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} - name: Login to GitHub Container Registry