Merge pull request #291 from zowe/user/markackert/sigstore-bundles

create sigstore signature for cli bundles
zowe · Oct 3, 2024 · 07dfd5c · 07dfd5c
2 parents d20c502 + d12e7a7
commit 07dfd5c
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 0 deletions.
diff --git a/.github/workflows/zowe-cli-bundle.yaml b/.github/workflows/zowe-cli-bundle.yaml
@@ -48,6 +48,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     permissions:
+      id-token: write
       pull-requests: write
     steps:
     - name: Checkout
@@ -164,6 +165,16 @@ jobs:
         name: 'zowe-cli-bundle_${{ inputs.package-tag }}'
         path: '*.zip'
 
+    - name: Sigstore sign bundles
+      uses: zowe-actions/shared-actions/sigstore-sign-artifacts@main
+      with:
+        artifacts: |
+          zowe-cli-package-${{ env.BUNDLE_VERSION }}.zip
+          zowe-cli-plugins-${{ env.BUNDLE_VERSION }}.zip
+          zowe-nodejs-sdk*-${{ env.BUNDLE_VERSION }}.zip  
+          zowe-python-sdk*-${{ env.BUNDLE_VERSION }}.zip
+
+    # prepare-upload attachs the sigstore bundles as well
     - name: Add Bundles to Spec
       run: |
         node scripts/prepare-upload.js "zowe-cli-package-${{ env.BUNDLE_VERSION }}.zip" \

diff --git a/scripts/prepare-upload.js b/scripts/prepare-upload.js
@@ -23,6 +23,12 @@ if (fs.existsSync(uploadSpecFile)) {
     uploadSpecJson = jsonfile.readFileSync(uploadSpecFile);
 }
 uploadSpecJson.files.push({ pattern: sourcePath, target: targetPath });
+
+// check for an associated sigstore signature, in case of wildcard let jfrog cli find it
+if (fs.existsSync(`${sourcePath}.bundle`) || sourcePath.includes('*')) {
+    uploadSpecJson.files.push({ pattern: `${sourcePath}.bundle`, target: targetPath})
+}
+
 jsonfile.writeFileSync(uploadSpecFile, uploadSpecJson, { spaces: 4 });
 
 if (!fs.existsSync(summaryFile)) {