Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions .github/actions/install-cosign/action.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
name: "Install cosign"
description: |
Cosign Github Action.
runs:
using: "composite"
steps:
- name: Install cosign
uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
with:
cosign-release: "v2.4.3"
10 changes: 10 additions & 0 deletions .github/actions/install-syft/action.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
name: "Install syft"
description: |
Downloads Syft to the Action tool cache and provides a reference.
runs:
using: "composite"
steps:
- name: Install syft
uses: anchore/sbom-action/download-syft@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0.18.0
with:
syft-version: "v1.20.0"
8 changes: 2 additions & 6 deletions .github/workflows/ci.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -1074,14 +1074,10 @@ jobs:
run: sudo apt-get install -y zstd

- name: Install cosign
uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
with:
cosign-release: "v2.4.3"
uses: ./.github/actions/install-cosign

- name: Install syft
uses: anchore/sbom-action/download-syft@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0.18.0
with:
syft-version: "v1.20.0"
uses: ./.github/actions/install-syft

- name: Setup Windows EV Signing Certificate
run: |
Expand Down
8 changes: 2 additions & 6 deletions .github/workflows/release.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -251,14 +251,10 @@ jobs:
rm /tmp/rcodesign.tar.gz

- name: Install cosign
uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
with:
cosign-release: "v2.4.3"
uses: ./.github/actions/install-cosign

- name: Install syft
uses: anchore/sbom-action/download-syft@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0.18.0
with:
syft-version: "v1.20.0"
uses: ./.github/actions/install-syft

- name: Setup Apple Developer certificate and API key
run: |
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/security.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,12 @@ jobs:
- name: Setup sqlc
uses: ./.github/actions/setup-sqlc

- name: Install cosign
uses: ./.github/actions/install-cosign

- name: Install syft
uses: ./.github/actions/install-syft

- name: Install yq
run: go run github.com/mikefarah/yq/v4@v4.44.3
- name: Install mockgen
Expand Down
Loading