Spoolman

0 Fork 0

mirror of https://github.com/Donkie/Spoolman.git synced 2026-10-22 01:52:17 -05:00

Files

T

Aleksei Sviridkin fc606ec8fc ci: sign the released images with cosign (#963 )

Published images carry no signature, so there is no way for a user to verify
that the image they pull was built by this workflow from this repository.

Sign them keyless, using the Github OIDC token, so verification needs no key
material on either side. The manifest is signed by digest rather than by tag:
every tag produced for a release points at the same digest, and the same
digest is valid in both registries the build pushes to, so signing each tag
would only repeat the same signature.

Verify with:

    cosign verify ghcr.io/donkie/spoolman:<version> \
      --certificate-identity-regexp '^https://github\.com/Donkie/Spoolman/\.github/workflows/ci\.yml@refs/' \
      --certificate-oidc-issuer https://token.actions.githubusercontent.com

Assisted-By: Claude <noreply@anthropic.com>

Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-07-21 22:07:57 +02:00

apidocs.yml

CI fixes

2026-01-18 16:55:31 +01:00

ci.yml

ci: sign the released images with cosign (#963 )

2026-07-21 22:07:57 +02:00

guard-translations.yml

Add CI guard blocking manual edits to non-English translations

2026-07-07 09:35:12 +02:00

issue-manager.yml

Add issue manager workflow for automated issue handling