Skip to content

Commit 58fad74

Browse files
JasonPowrJasonPowr
authored
Merge pull request #404 from securesign/update-to-v1.3.9
Update to v1.3.9
2 parents 52451eb + 9b60315 commit 58fad74

34 files changed

+1005
-548
lines changed

‎.github/workflows/build.yml

+5-3
Original file line numberDiff line numberDiff line change
@@ -35,20 +35,22 @@ jobs:
3535

3636
steps:
3737
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
38+
with:
39+
persist-credentials: false
3840
- uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
3941

4042
- name: Extract version of Go to use
41-
run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
43+
run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
4244

43-
- uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
45+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
4446
with:
4547
go-version: ${{ env.GOVERSION }}
4648
check-latest: true
4749

4850
- name: deps
4951
run: sudo apt-get update && sudo apt-get install -yq libpcsclite-dev
5052

51-
- uses: ko-build/setup-ko@3aebd0597dc1e9d1a26bcfdb7cbeb19c131d3037 # v0.7
53+
- uses: ko-build/setup-ko@d982fec422852203cfb2053a8ec6ad302280d04d # v0.8
5254

5355
- name: Set up Cloud SDK
5456
uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2.1.7

‎.github/workflows/codeql-analysis.yml

+10-9
Original file line numberDiff line numberDiff line change
@@ -27,14 +27,13 @@ on:
2727
schedule:
2828
- cron: '45 10 * * 1'
2929

30-
permissions:
31-
contents: read
32-
security-events: write
33-
3430
jobs:
3531
analyze:
3632
name: Analyze
3733
runs-on: ubuntu-latest
34+
permissions:
35+
contents: read
36+
security-events: write
3837

3938
strategy:
4039
fail-fast: false
@@ -44,23 +43,25 @@ jobs:
4443
steps:
4544
- name: Checkout repository
4645
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
46+
with:
47+
persist-credentials: false
4748

4849
- name: Extract version of Go to use
49-
run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
50+
run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
5051

51-
- uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
52+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
5253
with:
5354
go-version: ${{ env.GOVERSION }}
5455
check-latest: true
5556

5657
# Initializes the CodeQL tools for scanning.
5758
- name: Initialize CodeQL
58-
uses: github/codeql-action/init@65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 # v2.16.1
59+
uses: github/codeql-action/init@f6091c0113d1dcf9b98e269ee48e8a7e51b7bdd4 # v3.28.5
5960
with:
6061
languages: ${{ matrix.language }}
6162

6263
- name: Autobuild
63-
uses: github/codeql-action/autobuild@65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 # v2.16.1
64+
uses: github/codeql-action/autobuild@f6091c0113d1dcf9b98e269ee48e8a7e51b7bdd4 # v3.28.5
6465

6566
- name: Perform CodeQL Analysis
66-
uses: github/codeql-action/analyze@65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 # v2.16.1
67+
uses: github/codeql-action/analyze@f6091c0113d1dcf9b98e269ee48e8a7e51b7bdd4 # v3.28.5

‎.github/workflows/main.yml

+53-28
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
#
1+
22
# Copyright 2021 The Sigstore Authors.
33
#
44
# Licensed under the Apache License, Version 2.0 (the "License");
@@ -34,9 +34,11 @@ jobs:
3434

3535
steps:
3636
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
37+
with:
38+
persist-credentials: false
3739
- name: Extract version of Go to use
38-
run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
39-
- uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
40+
run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
41+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
4042
with:
4143
go-version: ${{ env.GOVERSION }}
4244

@@ -47,7 +49,7 @@ jobs:
4749
- name: Test
4850
run: go test -v -coverprofile=coverage.txt -covermode=atomic ./...
4951
- name: Upload Coverage Report
50-
uses: codecov/codecov-action@5c47607acb93fed5485fdbf7232e8a31425f672a # v5.0.2
52+
uses: codecov/codecov-action@13ce06bfc6bbe3ecf90edbbf1bc32fe5978ca1d3 # v5.3.1
5153
with:
5254
flags: unittests
5355
- name: Ensure no files were modified as a result of the build
@@ -57,13 +59,15 @@ jobs:
5759
runs-on: ubuntu-latest
5860
steps:
5961
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
62+
with:
63+
persist-credentials: false
6064
- name: Extract version of Go to use
61-
run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
62-
- uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
65+
run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
66+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
6367
with:
6468
go-version: ${{ env.GOVERSION }}
6569

66-
- uses: ko-build/setup-ko@3aebd0597dc1e9d1a26bcfdb7cbeb19c131d3037 # v0.7
70+
- uses: ko-build/setup-ko@d982fec422852203cfb2053a8ec6ad302280d04d # v0.8
6771

6872
- name: container
6973
run: |
@@ -77,14 +81,18 @@ jobs:
7781
needs: build
7882

7983
steps:
84+
- name: Set up Homebrew
85+
id: set-up-homebrew
86+
uses: Homebrew/actions/setup-homebrew@40e9946c182a64b3db1bf51be0dcb915f7802aa9
8087
- name: download minisign
81-
# run: sudo add-apt-repository ppa:dysfunctionalprogramming/minisign && sudo apt-get update && sudo apt-get install minisign
82-
run: sudo add-apt-repository ppa:savoury1/minisign && sudo apt-get update && sudo apt-get install minisign
83-
88+
run: |
89+
brew install minisign
8490
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
91+
with:
92+
persist-credentials: false
8593
- name: Extract version of Go to use
86-
run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
87-
- uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
94+
run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
95+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
8896
with:
8997
go-version: ${{ env.GOVERSION }}
9098
- name: install gocovmerge
@@ -107,13 +115,13 @@ jobs:
107115
env:
108116
INDEX_BACKEND: redis
109117
- name: Upload logs if they exist
110-
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
118+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
111119
if: failure()
112120
with:
113121
name: E2E Docker Compose logs
114122
path: /tmp/docker-compose.log
115123
- name: Upload Coverage Report
116-
uses: codecov/codecov-action@5c47607acb93fed5485fdbf7232e8a31425f672a # v5.0.2
124+
uses: codecov/codecov-action@13ce06bfc6bbe3ecf90edbbf1bc32fe5978ca1d3 # v5.3.1
117125
with:
118126
files: /tmp/rekor-merged.cov,/tmp/pkg-rekor-merged.cov
119127
flags: e2etests
@@ -123,10 +131,18 @@ jobs:
123131
needs: build
124132

125133
steps:
134+
- name: Set up Homebrew
135+
id: set-up-homebrew
136+
uses: Homebrew/actions/setup-homebrew@40e9946c182a64b3db1bf51be0dcb915f7802aa9
137+
- name: download minisign
138+
run: |
139+
brew install minisign
126140
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
141+
with:
142+
persist-credentials: false
127143
- name: Extract version of Go to use
128-
run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
129-
- uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
144+
run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
145+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
130146
with:
131147
go-version: ${{ env.GOVERSION }}
132148
- name: Install backfill test dependencies
@@ -149,7 +165,7 @@ jobs:
149165
- name: Copy index test
150166
run: ./tests/copy-index-test.sh
151167
- name: Upload logs if they exist
152-
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
168+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
153169
if: failure()
154170
with:
155171
name: E2E Docker Compose logs
@@ -160,22 +176,27 @@ jobs:
160176
needs: build
161177

162178
steps:
179+
- name: Set up Homebrew
180+
id: set-up-homebrew
181+
uses: Homebrew/actions/setup-homebrew@40e9946c182a64b3db1bf51be0dcb915f7802aa9
163182
- name: download minisign
164-
# run: sudo add-apt-repository ppa:dysfunctionalprogramming/minisign && sudo apt-get update && sudo apt-get install minisign
165-
run: sudo add-apt-repository ppa:savoury1/minisign && sudo apt-get update && sudo apt-get install minisign
183+
run: |
184+
brew install minisign
166185
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
186+
with:
187+
persist-credentials: false
167188
- name: Docker Build
168189
run: docker compose build
169190
- name: Extract version of Go to use
170-
run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
171-
- uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
191+
run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
192+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
172193
with:
173194
go-version: ${{ env.GOVERSION }}
174195

175196
- name: Sharding Test
176197
run: ./tests/sharding-e2e-test.sh
177198
- name: Upload logs if they exist
178-
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
199+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
179200
if: failure()
180201
with:
181202
name: Sharding E2E Docker Compose logs
@@ -187,18 +208,20 @@ jobs:
187208

188209
steps:
189210
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
211+
with:
212+
persist-credentials: false
190213
- name: Docker Build
191214
run: docker compose build
192215
- name: Extract version of Go to use
193-
run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
194-
- uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
216+
run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
217+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
195218
with:
196219
go-version: ${{ env.GOVERSION }}
197220

198221
- name: Test for Attestation begin returned that was previously persisted in tlog
199222
run: ./tests/issue-872-e2e-test.sh
200223
- name: Upload logs if they exist
201-
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
224+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
202225
if: failure()
203226
with:
204227
name: Docker Compose logs
@@ -209,14 +232,16 @@ jobs:
209232
needs: build
210233
steps:
211234
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
235+
with:
236+
persist-credentials: false
212237

213238
- name: Create git branch
214239
run: git switch -c harness-test-branch
215240

216241
- name: Extract version of Go to use
217-
run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
242+
run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
218243

219-
- uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
244+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
220245
with:
221246
go-version: ${{ env.GOVERSION }}
222247
check-latest: true
@@ -225,7 +250,7 @@ jobs:
225250
run: ./tests/rekor-harness.sh
226251

227252
- name: Upload logs if they exist
228-
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
253+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
229254
if: failure()
230255
with:
231256
name: E2E Docker Compose logs

‎.github/workflows/milestone.yml

-54
This file was deleted.

‎.github/workflows/validate-release.yml

+5-3
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,9 @@ jobs:
3333
steps:
3434
- name: Check Signature
3535
run: |
36-
cosign verify ghcr.io/gythialy/golang-cross:v1.23.2@sha256:85c8e52bccf05564aa6284affd4eb197507cb22606e0bb8a2deeab3c0b779d87 \
36+
cosign verify ghcr.io/gythialy/golang-cross:v1.23.4-0@sha256:fac6f9675e3e3a4ccc2b8cdab87b907cabae3a9c4e046d16816b9876315005e4 \
3737
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
38-
--certificate-identity "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.23.2"
38+
--certificate-identity "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.23.4-0"
3939
env:
4040
TUF_ROOT: /tmp
4141

@@ -44,10 +44,12 @@ jobs:
4444
needs:
4545
- check-signature
4646
container:
47-
image: ghcr.io/gythialy/golang-cross:v1.23.2@sha256:85c8e52bccf05564aa6284affd4eb197507cb22606e0bb8a2deeab3c0b779d87
47+
image: ghcr.io/gythialy/golang-cross:v1.23.4-0@sha256:fac6f9675e3e3a4ccc2b8cdab87b907cabae3a9c4e046d16816b9876315005e4
4848

4949
steps:
5050
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
51+
with:
52+
persist-credentials: false
5153

5254
# Error: fatal: detected dubious ownership in repository at '/__w/rekor/rekor'
5355
# To add an exception for this directory, call:

‎.github/workflows/verify.yml

+10-7
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,13 @@ jobs:
3030
runs-on: ubuntu-latest
3131
steps:
3232
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
33+
with:
34+
persist-credentials: false
3335

3436
- name: Extract version of Go to use
35-
run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
37+
run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
3638

37-
- uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
39+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
3840
with:
3941
go-version: ${{ env.GOVERSION }}
4042

@@ -52,16 +54,17 @@ jobs:
5254
runs-on: ubuntu-latest
5355
steps:
5456
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
57+
with:
58+
persist-credentials: false
5559

5660
- name: Extract version of Go to use
57-
run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
61+
run: echo "GOVERSION=$(awk -F'[:@]' '/FROM golang/{print $2; exit}' Dockerfile)" >> $GITHUB_ENV
5862

59-
- uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
63+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
6064
with:
6165
go-version: ${{ env.GOVERSION }}
6266

6367
- name: golangci-lint
64-
uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1
65-
timeout-minutes: 10
68+
uses: golangci/golangci-lint-action@ec5d18412c0aeab7936cb16880d708ba2a64e1ae # v6.2.0
6669
with:
67-
version: v1.61
70+
version: v1.62

0 commit comments

Comments
 (0)