Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Workflow updates #1378

Merged
merged 4 commits into from
Sep 11, 2024
Merged

Workflow updates #1378

merged 4 commits into from
Sep 11, 2024

Conversation

jku
Copy link
Member

@jku jku commented Sep 10, 2024

This contains four separate workflow changes that I can put in separate PRs if requested to. These are all workflow related changes that have been tested in root-signing-staging:

  • Do not always require future validity in test: this allows repository to get published even when signing event is for some reason not proceeding as quickly as expected
  • Prevent signing-event from running in forks
  • Add client test for older cosign
  • remove golang from dependabot config

Fixes #1376

There is no go code anymore

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
Test an older cosign version we want to support (we don't have the
maintainer resources for a full matrix of all versions of all clients,
but cosign is the most used client by far so let's test that)

This has been tested in root-signing-staging.

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
signing-event can result in strange PR comments getting generated if the
workflow runs in signers fork. Prevent this.

This has been tested in root-signing-staging.

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
test.yml and test-gcs.yml currently always fail if the repository is not
valid for 3 days (or if root & targets are not valid in 30 days). This
is reasonable for standalone tests but not when tests are run during
publish: As an example publishing should succeed after online signing
even if root is expiring in a few weeks.

Do not require repository to be valid at a future date when tests are
running as reusable workflow (in other words from publish.yml), only
require it to be valid at current time.

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>
@jku jku merged commit 19bb6a2 into sigstore:main Sep 11, 2024
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Update workflows with improvements from root-signing-staging
3 participants