Skip to content

Commit

Permalink
Sign artifacts using cosign (#2)
Browse files Browse the repository at this point in the history
  • Loading branch information
btj authored May 4, 2023
1 parent 292093d commit 37740a3
Showing 1 changed file with 31 additions and 0 deletions.
31 changes: 31 additions & 0 deletions .github/workflows/build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -7,10 +7,15 @@ env:
COMMON_CMAKE_VARS: ${{ '-DLLVM_ENABLE_PROJECTS=clang -DLLVM_BUILD_TOOLS=OFF -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=OFF -DLLVM_BUILD_LLVM_DYLIB=OFF -DLLVM_ENABLE_BINDINGS=OFF -DLLVM_ENABLE_FFI=OFF -DLLVM_ENABLE_ZLIB=OFF -DLLVM_ENABLE_LIBXML2=OFF -DLLVM_ENABLE_TERMINFO=OFF -DLLVM_ENABLE_ZSTD=OFF -DLLVM_TARGETS_TO_BUILD=X86' }}
SHASUM_FILE: 'sha256.txt'

permissions:
id-token: write

jobs:
MacOS:
runs-on: macos-11
steps:
- name: Install cosign
uses: sigstore/[email protected]
- uses: actions/checkout@v3
- name: Create package name
run: |
Expand Down Expand Up @@ -38,16 +43,23 @@ jobs:
- name: Produce shasum 256
run: |
shasum -a 256 ${{ runner.temp }}/${{ env.PACKAGE_NAME }}-${{ runner.os }}.tar.gz > ${{ runner.temp }}/${{ env.SHASUM_FILE }}
- name: Sign artifact
run: |
cd ${{ runner.temp }}
cosign sign-blob -y ${{ env.PACKAGE_NAME }}-${{ runner.os }}.tar.gz --bundle ${{ env.PACKAGE_NAME }}-${{ runner.os }}.tar.gz.signature
- uses: actions/[email protected]
with:
name: vf-llvm-clang-${{ runner.os }}
path: |
${{ runner.temp }}/${{ env.PACKAGE_NAME }}-${{ runner.os }}.tar.gz
${{ runner.temp }}/${{ env.PACKAGE_NAME }}-${{ runner.os }}.tar.gz.signature
${{ runner.temp }}/${{ env.SHASUM_FILE }}
Linux:
runs-on: ubuntu-20.04
steps:
- name: Install cosign
uses: sigstore/[email protected]
- uses: actions/checkout@v3
- name: Create package name
run: |
Expand Down Expand Up @@ -75,11 +87,16 @@ jobs:
- name: Produce shasum 256
run: |
shasum -a 256 ${{ runner.temp }}/${{ env.PACKAGE_NAME }}-${{ runner.os }}.tar.gz > ${{ runner.temp }}/${{ env.SHASUM_FILE }}
- name: Sign artifact
run: |
cd ${{ runner.temp }}
cosign sign-blob -y ${{ env.PACKAGE_NAME }}-${{ runner.os }}.tar.gz --bundle ${{ env.PACKAGE_NAME }}-${{ runner.os }}.tar.gz.signature
- uses: actions/[email protected]
with:
name: vf-llvm-clang-${{ runner.os }}
path: |
${{ runner.temp }}/${{ env.PACKAGE_NAME }}-${{ runner.os }}.tar.gz
${{ runner.temp }}/${{ env.PACKAGE_NAME }}-${{ runner.os }}.tar.gz.signature
${{ runner.temp }}/${{ env.SHASUM_FILE }}
MinGW:
Expand All @@ -90,6 +107,8 @@ jobs:
- x86_64
- i686
steps:
- name: Install cosign
uses: sigstore/[email protected]
- run: |
git config --global core.autocrlf input
- uses: actions/checkout@v3
Expand Down Expand Up @@ -128,11 +147,16 @@ jobs:
- name: Produce shasum 256
run: |
Get-FileHash -PATH "${{ runner.temp }}\${{ env.PACKAGE_NAME }}-${{ runner.os }}-MinGW-${{ matrix.cc_prefix }}.tar.gz" -Algorithm SHA256 | Out-File -FilePath ${{ runner.temp }}/${{ env.SHASUM_FILE }} -Encoding utf8
- name: Sign artifact
run: |
cd ${{ runner.temp }}
cosign sign-blob -y ${{ env.PACKAGE_NAME }}-${{ runner.os }}-MinGW-${{ matrix.cc_prefix }}.tar.gz --bundle ${{ env.PACKAGE_NAME }}-${{ runner.os }}-MinGW-${{ matrix.cc_prefix }}.tar.gz.signature
- uses: actions/[email protected]
with:
name: vf-llvm-clang-${{ runner.os }}-MinGW-${{ matrix.cc_prefix }}
path: |
${{ runner.temp }}/${{ env.PACKAGE_NAME }}-${{ runner.os }}-MinGW-${{ matrix.cc_prefix }}.tar.gz
${{ runner.temp }}/${{ env.PACKAGE_NAME }}-${{ runner.os }}-MinGW-${{ matrix.cc_prefix }}.tar.gz.signature
${{ runner.temp }}/${{ env.SHASUM_FILE }}
MSVC:
Expand All @@ -143,6 +167,8 @@ jobs:
- 'Win32'
- 'x64'
steps:
- name: Install cosign
uses: sigstore/[email protected]
- uses: actions/checkout@v3
- name: Create package name
run: |
Expand Down Expand Up @@ -173,9 +199,14 @@ jobs:
- name: Produce shasum 256
run: |
Get-FileHash -PATH "${{ runner.temp }}\${{ env.PACKAGE_NAME }}-${{ runner.os }}-MSVC-${{ matrix.arch }}.tar.gz" -Algorithm SHA256 | Out-File -FilePath ${{ runner.temp }}/${{ env.SHASUM_FILE }} -Encoding utf8
- name: Sign artifact
run: |
cd ${{ runner.temp }}
cosign sign-blob -y ${{ env.PACKAGE_NAME }}-${{ runner.os }}-MSVC-${{ matrix.arch }}.tar.gz --bundle ${{ env.PACKAGE_NAME }}-${{ runner.os }}-MSVC-${{ matrix.arch }}.tar.gz.signature
- uses: actions/[email protected]
with:
name: vf-llvm-clang-${{ runner.os }}-MSVC-${{ matrix.arch }}
path: |
${{ runner.temp }}/${{ env.PACKAGE_NAME }}-${{ runner.os }}-MSVC-${{ matrix.arch }}.tar.gz
${{ runner.temp }}/${{ env.PACKAGE_NAME }}-${{ runner.os }}-MSVC-${{ matrix.arch }}.tar.gz.signature
${{ runner.temp }}/${{ env.SHASUM_FILE }}

0 comments on commit 37740a3

Please sign in to comment.