Skip to content

Commit 2ddd7c2

Browse files
VonngVonng
committed
Add OpenSSF security automation workflows
1 parent 889e467 commit 2ddd7c2

4 files changed

Lines changed: 182 additions & 0 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: github-actions
4+
directory: /
5+
schedule:
6+
interval: weekly
7+
day: monday
8+
time: "09:00"
9+
timezone: Asia/Shanghai
10+
groups:
11+
github-actions:
12+
patterns:
13+
- "*"
14+
15+
- package-ecosystem: docker
16+
directory: /docker
17+
schedule:
18+
interval: weekly
19+
day: monday
20+
time: "09:00"
21+
timezone: Asia/Shanghai

‎.github/workflows/codeql.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
#==============================================================#
2+
# File : codeql.yml
3+
# Desc : CodeQL static analysis
4+
# Ctime : 2026-07-09
5+
# Mtime : 2026-07-09
6+
# License : Apache-2.0 @ https://pigsty.io/docs/about/license
7+
# Copyright : 2018-2026 Ruohang Feng / Vonng (rh@vonng.com)
8+
#==============================================================#
9+
10+
name: CodeQL
11+
12+
on:
13+
push:
14+
branches:
15+
- main
16+
pull_request:
17+
branches:
18+
- main
19+
schedule:
20+
- cron: "30 3 * * 1"
21+
workflow_dispatch:
22+
23+
permissions: read-all
24+
25+
jobs:
26+
analyze:
27+
name: Analyze (${{ matrix.language }})
28+
runs-on: ubuntu-latest
29+
permissions:
30+
contents: read
31+
security-events: write
32+
strategy:
33+
fail-fast: false
34+
matrix:
35+
language:
36+
- python
37+
38+
steps:
39+
- name: Checkout repository
40+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
41+
42+
- name: Initialize CodeQL
43+
uses: github/codeql-action/init@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3
44+
with:
45+
languages: ${{ matrix.language }}
46+
47+
- name: Perform CodeQL Analysis
48+
uses: github/codeql-action/analyze@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 # v3
49+
with:
50+
category: "/language:${{ matrix.language }}"

‎.github/workflows/release-sign.yml‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
#==============================================================#
2+
# File : release-sign.yml
3+
# Desc : Sign GitHub release assets with Sigstore cosign
4+
# Ctime : 2026-07-09
5+
# Mtime : 2026-07-09
6+
# License : Apache-2.0 @ https://pigsty.io/docs/about/license
7+
# Copyright : 2018-2026 Ruohang Feng / Vonng (rh@vonng.com)
8+
#==============================================================#
9+
10+
name: Sign Release Assets
11+
12+
on:
13+
workflow_dispatch:
14+
inputs:
15+
tag:
16+
description: "Release tag to sign, such as v4.3.0"
17+
required: true
18+
type: string
19+
20+
permissions: read-all
21+
22+
jobs:
23+
sign:
24+
name: Sign assets
25+
runs-on: ubuntu-latest
26+
if: github.ref == 'refs/heads/main'
27+
permissions:
28+
contents: write
29+
id-token: write
30+
31+
steps:
32+
- name: Install cosign
33+
uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
34+
with:
35+
cosign-release: v2.5.2
36+
37+
- name: Download release assets
38+
env:
39+
GH_TOKEN: ${{ github.token }}
40+
TAG: ${{ inputs.tag }}
41+
run: |
42+
set -euo pipefail
43+
mkdir -p dist/release-assets
44+
gh release download "${TAG}" \
45+
--repo "${GITHUB_REPOSITORY}" \
46+
--dir dist/release-assets \
47+
--clobber
48+
find dist/release-assets -maxdepth 1 -type f -print | sort
49+
50+
- name: Sign and upload assets
51+
env:
52+
GH_TOKEN: ${{ github.token }}
53+
TAG: ${{ inputs.tag }}
54+
run: |
55+
set -euo pipefail
56+
cd dist/release-assets
57+
shopt -s nullglob
58+
59+
expected_identity="https://github.com/${GITHUB_REPOSITORY}/.github/workflows/release-sign.yml@refs/heads/main"
60+
61+
assets=()
62+
for asset in *; do
63+
[ -f "${asset}" ] || continue
64+
case "${asset}" in
65+
*.sig|*.pem|*.intoto|*.intoto.jsonl|*.bundle|*.sigstore.json)
66+
continue
67+
;;
68+
esac
69+
assets+=("${asset}")
70+
done
71+
72+
if [ "${#assets[@]}" -eq 0 ]; then
73+
echo "No unsigned release assets found for ${TAG}."
74+
exit 0
75+
fi
76+
77+
for asset in "${assets[@]}"; do
78+
cosign sign-blob --yes \
79+
--output-signature "${asset}.sig" \
80+
--output-certificate "${asset}.pem" \
81+
"${asset}"
82+
83+
cosign verify-blob \
84+
--certificate "${asset}.pem" \
85+
--signature "${asset}.sig" \
86+
--certificate-identity "${expected_identity}" \
87+
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
88+
"${asset}"
89+
done
90+
91+
gh release upload "${TAG}" ./*.sig ./*.pem \
92+
--repo "${GITHUB_REPOSITORY}" \
93+
--clobber

‎README.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -191,6 +191,24 @@ git clone https://github.com/pgsty/pigsty; cd pigsty; git checkout v4.3.0
191191
192192
</details>
193193
194+
<details><summary>Verify release signatures</summary><br>
195+
196+
Release assets are signed with Sigstore/cosign keyless signatures. Download the
197+
asset with its `.sig` and `.pem` files, then verify the asset before use:
198+
199+
```bash
200+
gh release download v4.3.0 --repo pgsty/pigsty --pattern 'pigsty-v4.3.0.tgz*'
201+
202+
cosign verify-blob \
203+
--certificate pigsty-v4.3.0.tgz.pem \
204+
--signature pigsty-v4.3.0.tgz.sig \
205+
--certificate-identity 'https://github.com/pgsty/pigsty/.github/workflows/release-sign.yml@refs/heads/main' \
206+
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
207+
pigsty-v4.3.0.tgz
208+
```
209+
210+
</details>
211+
194212
195213
196214

0 commit comments

Comments
 (0)