fulcio/.github/workflows/e2e.yml at 77756b19f72513f5bf4f9edbc21da2230a97b333 · sigstore/fulcio · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
#
# Copyright 2025 The Sigstore Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: E2E

on:
  push:
    branches:
      - main
  pull_request:

permissions:
  contents: read

jobs:
  e2e:
    name: Verify docker compose functionality with cosign
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9

      - uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0

      - name: Start Fulcio services
        run: |
          docker compose up --build --wait -d

      - name: Make trusted root and signing config
        run: |
          cosign trusted-root create \
            --fulcio="url=http://localhost:5555,certificate-chain=./config/fulcio-root/root.pem" \
            --ctfe="url=http://localhost:6962,public-key=./config/ctfe/pubkey.pem,start-time=2025-11-25T21:41:42+00:00" \
            --out=trusted-root.json
          cosign signing-config create \
            --fulcio="url=http://localhost:5555,api-version=1,start-time=2024-01-01T00:00:00Z,operator=test" \
            --out=signing-config.json

      - name: Get test OIDC token
        uses: sigstore-conformance/extremely-dangerous-public-oidc-beacon@main

      - name: Sign and verify with ID token
        run: |
          set -e
          echo "sample blob" > myblob
          cosign sign-blob myblob \
            -y \
            --identity-token $(cat ./oidc-token.txt) \
            --trusted-root=trusted-root.json \
            --signing-config=signing-config.json \
            --bundle=bundle.json
          cosign verify-blob myblob \
            --insecure-ignore-tlog \
            --trusted-root=trusted-root.json \
            --certificate-identity=https://github.com/sigstore-conformance/extremely-dangerous-public-oidc-beacon/.github/workflows/extremely-dangerous-oidc-beacon.yml@refs/heads/main \
            --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
            --bundle=bundle.json