Skip to content

Commit ea63e31

Browse files
tommyd450tommyd450
committed
Merge tag 'v2.4.3'
v2.4.3
2 parents 8ade5cf + 6a7abbf commit ea63e31

File tree

140 files changed

+4122
-1052
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

140 files changed

+4122
-1052
lines changed

‎.github/workflows/build.yaml

+8-6
Original file line numberDiff line numberDiff line change
@@ -44,20 +44,22 @@ jobs:
4444
packages: write
4545

4646
steps:
47-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
47+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
48+
with:
49+
persist-credentials: false
4850

49-
- uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
51+
- uses: sigstore/cosign-installer@c56c2d3e59e4281cc41dea2217323ba5694b171e # v3.8.0
5052

51-
- uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
53+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
5254
with:
53-
go-version: '1.22'
55+
go-version-file: 'go.mod'
5456
check-latest: true
5557

5658
# will use the latest release available for ko
57-
- uses: ko-build/setup-ko@3aebd0597dc1e9d1a26bcfdb7cbeb19c131d3037 # v0.7
59+
- uses: ko-build/setup-ko@d982fec422852203cfb2053a8ec6ad302280d04d # v0.8
5860

5961
- name: Set up Cloud SDK
60-
uses: google-github-actions/auth@62cf5bd3e4211a0a0b51f2c6d6a37129d828611d # v2.1.5
62+
uses: google-github-actions/auth@71f986410dfbc7added4569d411d040a91dc6935 # v2.1.8
6163
with:
6264
workload_identity_provider: 'projects/498091336538/locations/global/workloadIdentityPools/githubactions/providers/sigstore-cosign'
6365
service_account: 'github-actions@projectsigstore.iam.gserviceaccount.com'

‎.github/workflows/codeql-analysis.yml

+6-4
Original file line numberDiff line numberDiff line change
@@ -51,10 +51,12 @@ jobs:
5151

5252
steps:
5353
- name: Checkout repository
54-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
54+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
55+
with:
56+
persist-credentials: false
5557

5658
- name: Utilize Go Module Cache
57-
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
59+
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
5860
with:
5961
path: |
6062
~/go/pkg/mod
@@ -64,9 +66,9 @@ jobs:
6466
${{ runner.os }}-go-
6567
6668
- name: Set correct version of Golang to use during CodeQL run
67-
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
69+
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
6870
with:
69-
go-version: '1.22'
71+
go-version-file: 'go.mod'
7072
check-latest: true
7173

7274
# Initializes the CodeQL tools for scanning.

‎.github/workflows/conformance-nightly.yml

+73
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# Copyright 2024 The Sigstore Authors.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
name: Conformance Tests Nightly
16+
17+
on:
18+
schedule:
19+
- cron: '0 0 * * *' # 12:00 AM UTC
20+
workflow_dispatch:
21+
22+
permissions:
23+
contents: read
24+
issues: write
25+
26+
jobs:
27+
conformance:
28+
runs-on: ubuntu-latest
29+
steps:
30+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
31+
with:
32+
persist-credentials: false
33+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
34+
with:
35+
go-version-file: 'go.mod'
36+
check-latest: true
37+
38+
- run: make cosign conformance
39+
40+
- uses: sigstore/sigstore-conformance@main
41+
with:
42+
entrypoint: ${{ github.workspace }}/conformance
43+
44+
- name: Create Issue on Failure
45+
if: failure()
46+
uses: actions/github-script@v7
47+
with:
48+
github-token: ${{ secrets.GITHUB_TOKEN }}
49+
script: |
50+
const { owner, repo } = context.repo;
51+
const runId = context.runId;
52+
const issueTitle = 'Conformance Tests Failed';
53+
const issueBody = `The nightly conformance tests have failed. Please check the logs for more details.\n\nWorkflow run: https://github.com/${owner}/${repo}/actions/runs/${runId}\n\ncc @sigstore/security-response-team @sigstore/cosign-codeowners`;
54+
const issueLabel = 'bug';
55+
56+
const existingIssues = await github.rest.issues.listForRepo({
57+
owner,
58+
repo,
59+
state: 'open',
60+
labels: issueLabel,
61+
});
62+
63+
const issueExists = existingIssues.data.some(issue => issue.title === issueTitle);
64+
65+
if (!issueExists) {
66+
await github.rest.issues.create({
67+
owner,
68+
repo,
69+
title: issueTitle,
70+
body: issueBody,
71+
labels: [issueLabel],
72+
});
73+
}

‎.github/workflows/conformance.yml

+6-4
Original file line numberDiff line numberDiff line change
@@ -29,14 +29,16 @@ jobs:
2929
conformance:
3030
runs-on: ubuntu-latest
3131
steps:
32-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
33-
- uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
32+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3433
with:
35-
go-version: '1.22'
34+
persist-credentials: false
35+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
36+
with:
37+
go-version-file: 'go.mod'
3638
check-latest: true
3739

3840
- run: make cosign conformance
3941

40-
- uses: sigstore/sigstore-conformance@ee4de0e602873beed74cf9e49d5332529fe69bf6 # v0.0.11
42+
- uses: sigstore/sigstore-conformance@d658ea74a060aeabae78f8a379167f219dc38c38 # v0.0.16
4143
with:
4244
entrypoint: ${{ github.workspace }}/conformance

‎.github/workflows/donotsubmit.yaml

+3-1
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,9 @@ jobs:
3535

3636
steps:
3737
- name: Check out code
38-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 #v2.4.0
38+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v2.4.0
39+
with:
40+
persist-credentials: false
3941

4042
- name: Do Not Submit
4143
uses: chainguard-dev/actions/donotsubmit@84c993eaf02da1c325854fb272a4df9184bd80fc # main

‎.github/workflows/e2e-tests.yml

+23-15
Original file line numberDiff line numberDiff line change
@@ -39,10 +39,12 @@ jobs:
3939
runs-on: ${{ matrix.os }}
4040

4141
steps:
42-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
43-
- uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
42+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4443
with:
45-
go-version: '1.22'
44+
persist-credentials: false
45+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
46+
with:
47+
go-version-file: 'go.mod'
4648
check-latest: true
4749

4850
- name: Run cross platform e2e tests
@@ -52,10 +54,12 @@ jobs:
5254
runs-on: ubuntu-latest
5355

5456
steps:
55-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
56-
- uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
57+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
58+
with:
59+
persist-credentials: false
60+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
5761
with:
58-
go-version: '1.22'
62+
go-version-file: 'go.mod'
5963
check-latest: true
6064

6165
- name: Run pkcs11 end-to-end tests
@@ -82,17 +86,19 @@ jobs:
8286
VAULT_TOKEN: "root"
8387
VAULT_ADDR: "http://localhost:8200"
8488
COSIGN_YES: "true"
85-
SCAFFOLDING_RELEASE_VERSION: "v0.7.11"
89+
SCAFFOLDING_RELEASE_VERSION: "v0.7.18"
8690
steps:
8791
- name: Checkout
88-
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
92+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
93+
with:
94+
persist-credentials: false
8995

9096
- name: setup vault
91-
uses: cpanato/vault-installer@892767a16fcd6afa5c4cceb557a6aacb73427ebb # v1.1.0
97+
uses: cpanato/vault-installer@e7c1d664fa15219e89e43739e39a9df11ba00849 # v1.2.0
9298

93-
- uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
99+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
94100
with:
95-
go-version: '1.22'
101+
go-version-file: 'go.mod'
96102
check-latest: true
97103

98104
- uses: imjasonh/setup-crane@31b88efe9de28ae0ffa220711af4b60be9435f6e # v0.4
@@ -112,13 +118,15 @@ jobs:
112118
runs-on: ubuntu-latest
113119

114120
env:
115-
SCAFFOLDING_RELEASE_VERSION: "v0.7.11"
121+
SCAFFOLDING_RELEASE_VERSION: "v0.7.18"
116122

117123
steps:
118-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
119-
- uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
124+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
125+
with:
126+
persist-credentials: false
127+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
120128
with:
121-
go-version: '1.22'
129+
go-version-file: 'go.mod'
122130
check-latest: true
123131

124132
- name: Setup mirror

‎.github/workflows/e2e-with-binary.yml

+5-3
Original file line numberDiff line numberDiff line change
@@ -48,10 +48,12 @@ jobs:
4848
COSIGN_YES: "true"
4949

5050
steps:
51-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
52-
- uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
51+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5352
with:
54-
go-version: '1.22'
53+
persist-credentials: false
54+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
55+
with:
56+
go-version-file: 'go.mod'
5557
check-latest: true
5658
- name: build cosign and check sign-blob and verify-blob
5759
shell: bash

‎.github/workflows/github-oidc.yaml

+6-4
Original file line numberDiff line numberDiff line change
@@ -48,15 +48,17 @@ jobs:
4848
KO_PREFIX: ghcr.io/${{ github.repository }}
4949

5050
steps:
51-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
52-
- uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
51+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5352
with:
54-
go-version: '1.22'
53+
persist-credentials: false
54+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
55+
with:
56+
go-version-file: 'go.mod'
5557
check-latest: true
5658
cache: true
5759

5860
# Install tools.
59-
- uses: ko-build/setup-ko@3aebd0597dc1e9d1a26bcfdb7cbeb19c131d3037 # v0.7
61+
- uses: ko-build/setup-ko@d982fec422852203cfb2053a8ec6ad302280d04d # v0.8
6062

6163
- name: build cosign from the HEAD
6264
run: |

‎.github/workflows/golangci-lint.yml

+14-11
Original file line numberDiff line numberDiff line change
@@ -31,16 +31,17 @@ jobs:
3131
contents: read
3232

3333
steps:
34-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
35-
- uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
34+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3635
with:
37-
go-version: '1.22'
36+
persist-credentials: false
37+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
38+
with:
39+
go-version-file: 'go.mod'
3840
check-latest: true
3941
- name: golangci-lint
40-
uses: golangci/golangci-lint-action@aaa42aa0628b4ae2578232a66b541047968fac86 # v6.1.0
42+
uses: golangci/golangci-lint-action@2226d7cb06a077cd73e56eedd38eecad18e5d837 # v6.5.0
4143
with:
42-
version: v1.60
43-
args: --timeout=5m
44+
version: v1.63
4445

4546
golangci-test-e2e:
4647
name: lint-test-e2e
@@ -50,13 +51,15 @@ jobs:
5051
contents: read
5152

5253
steps:
53-
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
54-
- uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
54+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
55+
with:
56+
persist-credentials: false
57+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
5558
with:
56-
go-version: '1.22'
59+
go-version-file: 'go.mod'
5760
check-latest: true
5861
- name: golangci-lint
59-
uses: golangci/golangci-lint-action@aaa42aa0628b4ae2578232a66b541047968fac86 # v6.1.0
62+
uses: golangci/golangci-lint-action@2226d7cb06a077cd73e56eedd38eecad18e5d837 # v6.5.0
6063
with:
61-
version: v1.60
64+
version: v1.63
6265
args: --timeout=5m --build-tags e2e ./test

0 commit comments

Comments
 (0)