rekor/release/cloudbuild.yaml at main · harryfallows/rekor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
#
# Copyright 2021 The Sigstore Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

timeout: 3600s

steps:
- name: gcr.io/cloud-builders/git
  dir: "go/src/sigstore"
  args:
  - "clone"
  - "https://github.com/${_TOOL_ORG}/${_TOOL_REPO}"

- name: gcr.io/cloud-builders/git
  entrypoint: "bash"
  dir: "go/src/sigstore/rekor"
  args:
  - '-c'
  - |
    git fetch
    echo "Checking out ${_TOOL_REF}"
    git checkout ${_TOOL_REF}

- name: 'gcr.io/projectsigstore/cosign:1.3.0@sha256:65de2f3f2844815ed20ab939319e3dad4238a9aaaf4893b22ec5702e9bc33755'
  dir: "go/src/sigstore/rekor"
  args:
  - 'verify'
  - '--key'
  - 'https://raw.githubusercontent.com/gythialy/golang-cross/master/cosign.pub'
  - 'ghcr.io/gythialy/golang-cross:v1.17.3-1@sha256:f934a6b0411bbe6723a65732baa8ff7e318cc2d8b089afddb41be3d60d0ea1ae'

- name: ghcr.io/gythialy/golang-cross:v1.17.3-1@sha256:f934a6b0411bbe6723a65732baa8ff7e318cc2d8b089afddb41be3d60d0ea1ae
  entrypoint: /bin/sh
  dir: "go/src/sigstore/rekor"
  env:
  - "GOPATH=/workspace/go"
  - "GOBIN=/workspace/bin"
  - PROJECT_ID=${PROJECT_ID}
  - KEY_LOCATION=${_KEY_LOCATION}
  - KEY_RING=${_KEY_RING}
  - KEY_NAME=${_KEY_NAME}
  - KEY_VERSION=${_KEY_VERSION}
  - GIT_TAG=${_GIT_TAG}
  secretEnv:
  - GITHUB_TOKEN
  args:
    - '-c'
    - |
      git tag ${_GIT_TAG}
      make release

- name: ghcr.io/gythialy/golang-cross:v1.17.3-1@sha256:f934a6b0411bbe6723a65732baa8ff7e318cc2d8b089afddb41be3d60d0ea1ae
  entrypoint: 'bash'
  dir: "go/src/sigstore/rekor"
  env:
  - "GOPATH=/workspace/go"
  - "GOBIN=/workspace/bin"
  - PROJECT_ID=${PROJECT_ID}
  - KEY_LOCATION=${_KEY_LOCATION}
  - KEY_RING=${_KEY_RING}
  - KEY_NAME=${_KEY_NAME}
  - KEY_VERSION=${_KEY_VERSION}
  - GIT_TAG=${_GIT_TAG}
  - KO_PREFIX=gcr.io/${PROJECT_ID}
  secretEnv:
  - GITHUB_TOKEN
  args:
    - '-c'
    - |
      gcloud auth configure-docker \
      && make sign-container-release

availableSecrets:
  secretManager:
  - versionName: projects/${PROJECT_NUMBER}/secrets/GITHUB_TOKEN/versions/latest
    env: GITHUB_TOKEN

artifacts:
  objects:
    location: 'gs://${_STORAGE_LOCATION}/${_GIT_TAG}'
    paths:
    - "go/src/sigstore/rekor/dist/rekor*"

options:
  machineType: E2_HIGHCPU_8

tags:
- rekor-release
- ${_GIT_TAG}
- ${_TOOL_ORG}
- ${_TOOL_REPO}
- ${_TOOL_REF}

substitutions:
  _GIT_TAG: 'v0.0.0'
  _TOOL_ORG: 'honk'
  _TOOL_REPO: 'honk-repo'
  _TOOL_REF: 'release-honk'
  _STORAGE_LOCATION: 'honk'
  _KEY_RING: 'honk-ring'
  _KEY_NAME: 'honk-crypto'
  _KEY_VERSION: '1'
  _KEY_LOCATION: 'global'