anders/my-ostree-OS
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

fix sign error and tag names

Browse source
This commit is contained in:
Anders da Silva Rytter Hansen 2026-01-05 16:58:50 -03:00
commit 5c8d0902d8
1 changed files with 14 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

23
.github/workflows/os.yml vendored
View file

@ -22,7 +22,7 @@ jobs:
permissions: permissions:
contents: read contents: read
packages: write packages: write
id-token: write id-token: write # Påkrævet til cosign keyless signering
steps: steps:
- name: Maximize build space - name: Maximize build space
@ -44,11 +44,12 @@ jobs:
uses: docker/metadata-action@v5 uses: docker/metadata-action@v5
with: with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
# Vi konstruerer tags her med branch-navnet som præfiks
tags: | tags: |
type=ref,event=branch type=ref,event=branch
type=raw,value=latest,enable={{is_default_branch}} type=raw,value=latest,enable={{is_default_branch}}
type=raw,value=10 type=raw,value=${{ github.ref_name }}-10
type=raw,value=10.${{ steps.date.outputs.date }} type=raw,value=${{ github.ref_name }}-10.${{ steps.date.outputs.date }}
- name: Log into GHCR - name: Log into GHCR
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request'
@ -58,22 +59,20 @@ jobs:
- name: Build image with Buildah - name: Build image with Buildah
id: build-image id: build-image
run: | run: |
# Vi bygger med et fast navn 'raw-img' lokalt # Vi bygger med 'raw-img' lokalt
buildah bud \ buildah bud \
--label "org.opencontainers.image.source=https://github.com/${{ github.repository }}" \ --label "org.opencontainers.image.source=https://github.com/${{ github.repository }}" \
-t raw-img . -t raw-img .
# Vi gemmer det første rigtige tag til senere brug (fx signering) # Gem det primære tag til signering (vi tager det første fra listen)
PRIMARY_TAG=$(echo "${{ steps.meta.outputs.tags }}" | head -n 1) PRIMARY_TAG=$(echo "${{ steps.meta.outputs.tags }}" | head -n 1)
echo "primary_tag=$PRIMARY_TAG" >> $GITHUB_OUTPUT echo "primary_tag=$PRIMARY_TAG" >> $GITHUB_OUTPUT
- name: Push to GHCR - name: Push to GHCR
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request'
run: | run: |
# Loop igennem alle de tags, som metadata-action genererede
for tag in $(echo "${{ steps.meta.outputs.tags }}"); do for tag in $(echo "${{ steps.meta.outputs.tags }}"); do
echo "Tagging and pushing: $tag" echo "Tagging and pushing: $tag"
# VI TILFØJER DETTE TRIN: Giv raw-img det rigtige navn før push
buildah tag raw-img "$tag" buildah tag raw-img "$tag"
buildah push "$tag" buildah push "$tag"
done done
@ -82,9 +81,15 @@ jobs:
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request'
uses: sigstore/cosign-installer@v3.3.0 uses: sigstore/cosign-installer@v3.3.0
# VI TILFØJER LOGIN TIL COSIGN HER
- name: Log into GHCR (Cosign)
if: github.event_name != 'pull_request'
run: |
cosign login ${{ env.REGISTRY }} -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }}
- name: Sign image - name: Sign image
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request'
run: | run: |
# Vi skal bruge buildah tag igen her for at sikre at PRIMARY_TAG findes lokalt # Vi signerer det primære tag.
buildah tag raw-img "${{ steps.build-image.outputs.primary_tag }}" # Vi bruger --yes til at acceptere betingelserne automatisk.
cosign sign --yes "${{ steps.build-image.outputs.primary_tag }}" cosign sign --yes "${{ steps.build-image.outputs.primary_tag }}"