38
38
# QUAY_IO_CREDS_PSW: ${{ secrets.QUAY_IO_CREDS_PSW }}
39
39
# ARTIFACTORY_IO_CREDS_PSW: ${{ secrets.ARTIFACTORY_IO_CREDS_PSW }}
40
40
# NEXUS_IO_CREDS_PSW: ${{ secrets.NEXUS_IO_CREDS_PSW }}
41
-
42
41
43
42
# 🖊️ EDIT to specify custom tags for the container image, or default tags will be generated below.
44
43
IMAGE_TAGS : " "
@@ -58,107 +57,107 @@ jobs:
58
57
environment : production
59
58
60
59
steps :
61
- - name : Check for required secrets
62
- uses : actions/github-script@v7
63
- with :
64
- script : |
65
- const vars = {
66
- IMAGE_REGISTRY: `${{ vars.IMAGE_REGISTRY }}`,
60
+ - name : Check for required secrets
61
+ uses : actions/github-script@v7
62
+ with :
63
+ script : |
64
+ const vars = {
65
+ IMAGE_REGISTRY: `${{ vars.IMAGE_REGISTRY }}`,
67
66
68
- /* Used to verify the image signature and attestation */
69
- COSIGN_PUBLIC_KEY: `${{ vars.COSIGN_PUBLIC_KEY }}`,
70
- /* URL of the BOMbastic api host (e.g. https://sbom.trustification.dev) */
71
- TRUSTIFICATION_BOMBASTIC_API_URL: `${{ vars.TRUSTIFICATION_BOMBASTIC_API_URL }}`,
72
- /* URL of the OIDC token issuer (e.g. https://sso.trustification.dev/realms/chicken) */
73
- TRUSTIFICATION_OIDC_ISSUER_URL: `${{ vars.TRUSTIFICATION_OIDC_ISSUER_URL }}`,
74
- TRUSTIFICATION_OIDC_CLIENT_ID: `${{ vars.TRUSTIFICATION_OIDC_CLIENT_ID }}`,
75
- TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION: `${{ vars.TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION }}`,
76
- /* Set this to the user for your specific registry */
77
- IMAGE_REGISTRY_USER: `${{ vars.IMAGE_REGISTRY_USER }}`,
78
- /* Set this only when using an external Rekor instance */
79
- REKOR_HOST: `${{ vars.REKOR_HOST }}`,
80
- /* Set this only when using an external TUF instance */
81
- TUF_MIRROR: `${{ vars.TUF_MIRROR }}`,
82
- /*QUAY_IO_CREDS_USR: `${{ vars.QUAY_IO_CREDS_USR }}`, */
83
- /*ARTIFACTORY_IO_CREDS_USR: `${{ vars.ARTIFACTORY_IO_CREDS_USR }}`, */
84
- /*NEXUS_IO_CREDS_USR: `${{ vars.NEXUS_IO_CREDS_USR }}`, */
85
- };
67
+ /* Used to verify the image signature and attestation */
68
+ COSIGN_PUBLIC_KEY: `${{ vars.COSIGN_PUBLIC_KEY }}`,
69
+ /* URL of the BOMbastic api host (e.g. https://sbom.trustification.dev) */
70
+ TRUSTIFICATION_BOMBASTIC_API_URL: `${{ vars.TRUSTIFICATION_BOMBASTIC_API_URL }}`,
71
+ /* URL of the OIDC token issuer (e.g. https://sso.trustification.dev/realms/chicken) */
72
+ TRUSTIFICATION_OIDC_ISSUER_URL: `${{ vars.TRUSTIFICATION_OIDC_ISSUER_URL }}`,
73
+ TRUSTIFICATION_OIDC_CLIENT_ID: `${{ vars.TRUSTIFICATION_OIDC_CLIENT_ID }}`,
74
+ TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION: `${{ vars.TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION }}`,
75
+ /* Set this to the user for your specific registry */
76
+ IMAGE_REGISTRY_USER: `${{ vars.IMAGE_REGISTRY_USER }}`,
77
+ /* Set this only when using an external Rekor instance */
78
+ REKOR_HOST: `${{ vars.REKOR_HOST }}`,
79
+ /* Set this only when using an external TUF instance */
80
+ TUF_MIRROR: `${{ vars.TUF_MIRROR }}`,
81
+ /*QUAY_IO_CREDS_USR: `${{ vars.QUAY_IO_CREDS_USR }}`,*/
82
+ /*ARTIFACTORY_IO_CREDS_USR: `${{ vars.ARTIFACTORY_IO_CREDS_USR }}`,*/
83
+ /*NEXUS_IO_CREDS_USR: `${{ vars.NEXUS_IO_CREDS_USR }}`,*/
84
+ };
86
85
87
- const missingVars = Object.entries(vars).filter(([ name, value ]) => {
88
- if (value.length === 0) {
89
- core.error(`Variable "${name}" is not set`);
90
- return true;
91
- }
92
- core.info(`✔️ Variable "${name}" is set`);
93
- return false;
94
- });
86
+ const missingVars = Object.entries(vars).filter(([ name, value ]) => {
87
+ if (value.length === 0) {
88
+ core.error(`Variable "${name}" is not set`);
89
+ return true;
90
+ }
91
+ core.info(`✔️ Variable "${name}" is set`);
92
+ return false;
93
+ });
95
94
96
- const secrets = {
95
+ const secrets = {
97
96
98
- TRUSTIFICATION_OIDC_CLIENT_SECRET: `${{ secrets.TRUSTIFICATION_OIDC_CLIENT_SECRET }}`,
99
- /* Set this password for your specific registry */
100
- IMAGE_REGISTRY_PASSWORD: `${{ secrets.IMAGE_REGISTRY_PASSWORD }}`,
101
- /*QUAY_IO_CREDS_PSW: `${{ secrets.QUAY_IO_CREDS_PSW }}`, */
102
- /*ARTIFACTORY_IO_CREDS_PSW: `${{ secrets.ARTIFACTORY_IO_CREDS_PSW }}`, */
103
- /*NEXUS_IO_CREDS_PSW: `${{ secrets.NEXUS_IO_CREDS_PSW }}`, */
104
- };
97
+ TRUSTIFICATION_OIDC_CLIENT_SECRET: `${{ secrets.TRUSTIFICATION_OIDC_CLIENT_SECRET }}`,
98
+ /* Set this password for your specific registry */
99
+ IMAGE_REGISTRY_PASSWORD: `${{ secrets.IMAGE_REGISTRY_PASSWORD }}`,
100
+ /*QUAY_IO_CREDS_PSW: `${{ secrets.QUAY_IO_CREDS_PSW }}`,*/
101
+ /*ARTIFACTORY_IO_CREDS_PSW: `${{ secrets.ARTIFACTORY_IO_CREDS_PSW }}`,*/
102
+ /*NEXUS_IO_CREDS_PSW: `${{ secrets.NEXUS_IO_CREDS_PSW }}`,*/
103
+ };
105
104
106
- const missingSecrets = Object.entries(secrets).filter(([ name, value ]) => {
107
- if (value.length === 0) {
108
- core.error(`Secret "${name}" is not set`);
109
- return true;
110
- }
111
- core.info(`✔️ Secret "${name}" is set`);
112
- return false;
113
- });
105
+ const missingSecrets = Object.entries(secrets).filter(([ name, value ]) => {
106
+ if (value.length === 0) {
107
+ core.error(`Secret "${name}" is not set`);
108
+ return true;
109
+ }
110
+ core.info(`✔️ Secret "${name}" is set`);
111
+ return false;
112
+ });
114
113
115
- if (missingVars.length > 0) {
116
- core.error(`❌ At least one required variable is not set in the repository. \n` +
117
- "You can add it using:\n" +
118
- "GitHub UI: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/store-information-in-variables#creating-configuration-variables-for-a-repository \n" +
119
- "GitHub CLI: https://cli.github.com/manual/gh_variable_set \n" +
120
- "Also, refer to https://github.com/redhat-actions/oc-login#getting-started-with-the-action-or-see-example");
121
- }
114
+ if (missingVars.length > 0) {
115
+ core.error(`❌ At least one required variable is not set in the repository. \n` +
116
+ "You can add it using:\n" +
117
+ "GitHub UI: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/store-information-in-variables#creating-configuration-variables-for-a-repository \n" +
118
+ "GitHub CLI: https://cli.github.com/manual/gh_variable_set \n" +
119
+ "Also, refer to https://github.com/redhat-actions/oc-login#getting-started-with-the-action-or-see-example");
120
+ }
122
121
123
- if (missingSecrets.length > 0) {
124
- core.error(`❌ At least one required secret is not set in the repository. \n` +
125
- "You can add it using:\n" +
126
- "GitHub UI: https://docs.github.com/en/actions/reference/encrypted-secrets#creating-encrypted-secrets-for-a-repository \n" +
127
- "GitHub CLI: https://cli.github.com/manual/gh_secret_set \n" +
128
- "Also, refer to https://github.com/redhat-actions/oc-login#getting-started-with-the-action-or-see-example");
129
- }
122
+ if (missingSecrets.length > 0) {
123
+ core.error(`❌ At least one required secret is not set in the repository. \n` +
124
+ "You can add it using:\n" +
125
+ "GitHub UI: https://docs.github.com/en/actions/reference/encrypted-secrets#creating-encrypted-secrets-for-a-repository \n" +
126
+ "GitHub CLI: https://cli.github.com/manual/gh_secret_set \n" +
127
+ "Also, refer to https://github.com/redhat-actions/oc-login#getting-started-with-the-action-or-see-example");
128
+ }
130
129
131
- if (missingVars.length > 0 || missingSecrets.length > 0) {
132
- core.setFailed()
133
- } else {
134
- core.info(`✅ All the required variables and secrets are set`);
135
- }
136
- - name : Check out repository
137
- uses : actions/checkout@v4
138
- with :
139
- fetch-depth : ' 2'
140
- - name : Pre-init
141
- run : |
142
- buildah --version
143
- syft --version
144
- cosign version
145
- ec version
146
- git config --global --add safe.directory $(pwd)
147
- cat rhtap/env.sh
148
- - name : Verify Ec
149
- run : |
150
- echo "• gather-deploy-images"
151
- bash /work/rhtap/gather-deploy-images.sh
152
- echo "• verify-enterprise-contract"
153
- bash /work/rhtap/verify-enterprise-contract.sh
154
- - name : Upload Sbom
155
- run : |
156
- echo "• gather-images-to-upload-sbom"
157
- bash /work/rhtap/gather-images-to-upload-sbom.sh
158
- echo "• download-sbom-from-url-in-attestation"
159
- bash /work/rhtap/download-sbom-from-url-in-attestation.sh
160
- echo "• upload-sbom-to-trustification"
161
- bash /work/rhtap/upload-sbom-to-trustification.sh
162
- - name : Done
163
- run : |
164
- echo "Done"
130
+ if (missingVars.length > 0 || missingSecrets.length > 0) {
131
+ core.setFailed()
132
+ } else {
133
+ core.info(`✅ All the required variables and secrets are set`);
134
+ }
135
+ - name : Check out repository
136
+ uses : actions/checkout@v4
137
+ with :
138
+ fetch-depth : ' 2'
139
+ - name : Pre-init
140
+ run : |
141
+ buildah --version
142
+ syft --version
143
+ cosign version
144
+ ec version
145
+ git config --global --add safe.directory $(pwd)
146
+ cat rhtap/env.sh
147
+ - name : Verify Ec
148
+ run : |
149
+ echo "• gather-deploy-images"
150
+ bash /work/rhtap/gather-deploy-images.sh
151
+ echo "• verify-enterprise-contract"
152
+ bash /work/rhtap/verify-enterprise-contract.sh
153
+ - name : Upload Sbom
154
+ run : |
155
+ echo "• gather-images-to-upload-sbom"
156
+ bash /work/rhtap/gather-images-to-upload-sbom.sh
157
+ echo "• download-sbom-from-url-in-attestation"
158
+ bash /work/rhtap/download-sbom-from-url-in-attestation.sh
159
+ echo "• upload-sbom-to-trustification"
160
+ bash /work/rhtap/upload-sbom-to-trustification.sh
161
+ - name : Done
162
+ run : |
163
+ echo "Done"
0 commit comments