- sigstore/cosign-installer to v3.0.1
- Put (exact) version comment behind all action references, while taking note
this is an absolute insane way to manage versions.
Signed-off-by: Hidde Beydals <hidde@hhh.computer>
- add the Flux manifests and API schemas to checksums
- sign the checksum.txt with Cosign and GitHub OIDC
- sign the flux-cli container images with Cosign and GitHub OIDC
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
- generate SBOM for Flux Go modules with Syft
- publish the SBOM SPDX JSON files to GitHub releases with GoReleaser
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
Signed-off-by: Chanwit Kaewkasi <chanwit@gmail.com>
This change publishes the auto-generated JSON schemas as a single URL,
so that it is consumable by a tool like VS Code.
The CRD generator creates 2 files, a tar.gz for Kubeval,
and another one is a JSON file. The JSON file is a combination of
all schemas, put under the "oneOf" operator.
This causes the format of the checksum file generated during the release
to change from `flux2_*_checksums.txt` to `flux_*_checksums.txt`.
The configuration change is made through `project_name` and not via the
`checksum.name_template` setting, because a single checksum file is
generated during the release process.
The download and/or installation script in `install/flux.sh` has been
adapted to assume the new filename starting with MINOR version `0.6.0`.
Signed-off-by: Hidde Beydals <hello@hidde.co>
Using a lock to prevent parallel executions in GoReleaser's custom
publishers. The custom publisher logic executes the tasks in parallel
for each available artifact.
https://goreleaser.com/customization/publishers/#how-it-works
Signed-off-by: Aurel Canciu <aurelcanciu@gmail.com>
