cosign/release/cloudbuild.yaml

#
# Copyright 2021 The Sigstore Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

timeout: 3600s

steps:
  - name: gcr.io/cloud-builders/git
    dir: "go/src/sigstore"
    args:
      - "clone"
      - "https://github.com/${_TOOL_ORG}/${_TOOL_REPO}"

  - name: gcr.io/cloud-builders/git
    entrypoint: "bash"
    dir: "go/src/sigstore/cosign"
    args:
      - '-c'
      - |
        git fetch
        echo "Checking out ${_GIT_TAG}"
        git checkout ${_GIT_TAG}

  - name: 'ghcr.io/sigstore/cosign/cosign:v3.1.4-dev@sha256:8af1a2cf9fba903fdfc6bdafdc25f7b13ef34ad722095543ea787fb96f7240c1'
    dir: "go/src/sigstore/cosign"
    env:
      - TUF_ROOT=/tmp
    args:
      - 'verify'
      - 'ghcr.io/gythialy/golang-cross:v1.27.1-1@sha256:b288b491c96203db38192b24e25f5769e8e2a6618ebaa44ec0e269e74a94447d'
      - '--certificate-oidc-issuer'
      - "https://token.actions.githubusercontent.com"
      - '--certificate-identity'
      - "https://github.com/gythialy/golang-cross/.github/workflows/builder.yml@refs/tags/v1.27.3-0"
  # maybe we can build our own image and use that to be more in a safe side
  - name: ghcr.io/gythialy/golang-cross:v1.27.3-0@sha256:c33ed060bb1817f4eed7957e3a22515823d194873a820722761ab5712298612e
    entrypoint: /bin/sh
    dir: "go/src/sigstore/cosign"
    env:
      - "GOTOOLCHAIN=go1.27.3"
      - "GOPATH=/workspace/go"
      - "GOBIN=/workspace/bin"
      - PROJECT_ID=${PROJECT_ID}
      - KEY_LOCATION=${_KEY_LOCATION}
      - KEY_RING=${_KEY_RING}
      - KEY_NAME=${_KEY_NAME}
      - KEY_VERSION=${_KEY_VERSION}
      - GIT_TAG=${_GIT_TAG}
      - GOOGLE_SERVICE_ACCOUNT_NAME=keyless@${PROJECT_ID}.iam.gserviceaccount.com
      - COSIGN_YES=true
      - KO_PREFIX=gcr.io/${PROJECT_ID}
    secretEnv:
      - GITHUB_TOKEN
    args:
      - '-c'
      - |
        gcloud auth configure-docker \
        && make release

  - name: ghcr.io/gythialy/golang-cross:v1.27.3-0@sha256:c33ed060bb1817f4eed7957e3a22515823d194873a820722761ab5712298612e
    entrypoint: 'bash'
    dir: "go/src/sigstore/cosign"
    env:
      - "GOPATH=/workspace/go"
      - "GOBIN=/workspace/bin"
      - "DOCKER_CONFIG=/workspace/.docker"
      - PROJECT_ID=${PROJECT_ID}
      - KEY_LOCATION=${_KEY_LOCATION}
      - KEY_RING=${_KEY_RING}
      - KEY_NAME=${_KEY_NAME}
      - KEY_VERSION=${_KEY_VERSION}
      - GIT_TAG=${_GIT_TAG}
      - KO_PREFIX=gcr.io/${PROJECT_ID}
      - COSIGN_YES=true
      - GOOGLE_SERVICE_ACCOUNT_NAME=keyless@${PROJECT_ID}.iam.gserviceaccount.com
      - GITHUB_USER=${_GITHUB_USER}
      - LATEST_TAG=",latest"
    secretEnv:
      - GITHUB_TOKEN
    args:
      - '-c'
      - |
        gcloud auth configure-docker --quiet \
        && echo $$GITHUB_TOKEN | docker login ghcr.io -u $$GITHUB_USER --password-stdin \
        && make sign-release-images

  - name: 'ghcr.io/oras-project/oras:v1.3.5@sha256:2f43a2bd4797df77ab38cf24ec92ae34a98a82cdf4ec507537e44081c603630e'
    env:
      - 'DOCKER_CONFIG=/workspace/.docker'
    args:
      - 'copy'
      - '-r'
      - 'gcr.io/${PROJECT_ID}/cosign:${_GIT_TAG}'
      - '${_GHCR_PREFIX}/cosign:${_GIT_TAG}'

  - name: 'ghcr.io/oras-project/oras:v1.3.5@sha256:2f43a2bd4797df77ab38cf24ec92ae34a98a82cdf4ec507537e44081c603630e'
    env:
      - 'DOCKER_CONFIG=/workspace/.docker'
    args:
      - 'copy'
      - '-r'
      - '${_GHCR_PREFIX}/cosign:${_GIT_TAG}'
      - '${_GHCR_PREFIX}/cosign:latest'

  - name: 'ghcr.io/oras-project/oras:v1.3.5@sha256:2f43a2bd4797df77ab38cf24ec92ae34a98a82cdf4ec507537e44081c603630e'
    env:
      - 'DOCKER_CONFIG=/workspace/.docker'
    args:
      - 'copy'
      - '-r'
      - 'gcr.io/${PROJECT_ID}/cosign:${_GIT_TAG}-dev'
      - '${_GHCR_PREFIX}/cosign:${_GIT_TAG}-dev'

  - name: 'ghcr.io/oras-project/oras:v1.3.5@sha256:2f43a2bd4797df77ab38cf24ec92ae34a98a82cdf4ec507537e44081c603630e'
    env:
      - 'DOCKER_CONFIG=/workspace/.docker'
    args:
      - 'copy'
      - '-r'
      - '${_GHCR_PREFIX}/cosign:${_GIT_TAG}-dev'
      - '${_GHCR_PREFIX}/cosign:latest-dev'


availableSecrets:
  secretManager:
    - versionName: projects/${PROJECT_NUMBER}/secrets/GITHUB_TOKEN/versions/latest
      env: GITHUB_TOKEN

artifacts:
  objects:
    location: 'gs://${_STORAGE_LOCATION}/${_GIT_TAG}'
    paths:
      - "go/src/sigstore/cosign/dist/*"
      - "go/src/sigstore/cosign/release/release-cosign.pub"

options:
  machineType: E2_HIGHCPU_32

tags:
  - cosign-release
  - ${_GIT_TAG}
  - ${_TOOL_ORG}
  - ${_TOOL_REPO}

substitutions:
  _GIT_TAG: 'v1.23.45'
  _TOOL_ORG: 'honk'
  _TOOL_REPO: 'honk-repo'
  _STORAGE_LOCATION: 'honk'
  _KEY_RING: 'honk-ring'
  _KEY_NAME: 'honk-crypto'
  _KEY_VERSION: '1'
  _KEY_LOCATION: 'global'
  _GITHUB_USER: 'placeholder'
  _GHCR_PREFIX: 'ghcr.io/sigstore/cosign'