DevOps/truecharts
2
0
Fork 0
Code Issues Pull Requests Actions 27 Packages Projects Releases 1 Wiki Activity

fix(ci): ensure sbom failure doesn't brick container creation

Browse Source
This commit is contained in:
Kjeld Schouten
2025-04-09 12:59:53 +02:00
parent ae234ca50f
commit f39ee0a99b
2 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/containers.build.yaml
+4 -2
View File
@@ -302,17 +302,19 @@ jobs:
cosign verify quay.io/tccr/${{ matrix.container }}@${{ steps.push.outputs.digest }} --certificate-oidc-issuer=https://token.actions.githubusercontent.com --certificate-identity=https://github.com/truecharts/public/.github/workflows/containers.build.yaml@refs/heads/master cosign verify quay.io/tccr/${{ matrix.container }}@${{ steps.push.outputs.digest }} --certificate-oidc-issuer=https://token.actions.githubusercontent.com --certificate-identity=https://github.com/truecharts/public/.github/workflows/containers.build.yaml@refs/heads/master
- name: Generate SBOM - name: Generate SBOM
id: generate_sbom
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request'
continue-on-error: true
run: | run: |
syft "quay.io/tccr/${{ matrix.container }}:v${{ steps.prep.outputs.version }}@${{ steps.push.outputs.digest }}" -o spdx-json=${{ matrix.container }}-sbom-spdx.json syft "quay.io/tccr/${{ matrix.container }}:v${{ steps.prep.outputs.version }}@${{ steps.push.outputs.digest }}" -o spdx-json=${{ matrix.container }}-sbom-spdx.json
- name: Attach SBOM to image - name: Attach SBOM to image
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request' && steps.generate_sbom.outcome == 'success'
run: | run: |
cosign attest --predicate ${{ matrix.container }}-sbom-spdx.json --type spdx "quay.io/tccr/${{ matrix.container }}@${{ steps.push.outputs.digest }}" -y cosign attest --predicate ${{ matrix.container }}-sbom-spdx.json --type spdx "quay.io/tccr/${{ matrix.container }}@${{ steps.push.outputs.digest }}" -y
- name: Verify SBOM attestation - name: Verify SBOM attestation
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request' && steps.generate_sbom.outcome == 'success'
run: | run: |
cosign verify-attestation quay.io/tccr/${{ matrix.container }}@${{ steps.push.outputs.digest }} --type https://spdx.dev/Document --certificate-oidc-issuer=https://token.actions.githubusercontent.com --certificate-identity=https://github.com/truecharts/containers/.github/workflows/containers.build.yaml@refs/heads/master | jq '.payload |= @base64d | .payload | fromjson' cosign verify-attestation quay.io/tccr/${{ matrix.container }}@${{ steps.push.outputs.digest }} --type https://spdx.dev/Document --certificate-oidc-issuer=https://token.actions.githubusercontent.com --certificate-identity=https://github.com/truecharts/containers/.github/workflows/containers.build.yaml@refs/heads/master | jq '.payload |= @base64d | .payload | fromjson'
containers/apps/renovate/Dockerfile
+1
View File
@@ -4,6 +4,7 @@ FROM docker.io/renovate/renovate:39.234.0-full
ARG VERSION ARG VERSION
ARG CONTAINER_NAME ARG CONTAINER_NAME
ARG CONTAINER_VER ARG CONTAINER_VER
ARG TEST
# Download and set up the clustertool binary # Download and set up the clustertool binary
RUN curl -L "https://github.com/truecharts/public/releases/download/v${VERSION}/clustertool_${VERSION}_linux_amd64.tar.gz" -o /tmp/clustertool.tar.gz \ RUN curl -L "https://github.com/truecharts/public/releases/download/v${VERSION}/clustertool_${VERSION}_linux_amd64.tar.gz" -o /tmp/clustertool.tar.gz \