Skip to content

Commit a99bc55

Browse files
alcaeusalcaeus
committed
Add GitHub Actions for artifact signing
1 parent 56af09b commit a99bc55

File tree

4 files changed

+199
-0
lines changed

4 files changed

+199
-0
lines changed

‎README.md

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# drivers-github-tools
2+
3+
> [!IMPORTANT]
4+
> This Repository is NOT a supported MongoDB product
5+
6+
This repository contains GitHub Actions that are common to drivers.
7+
8+
## Signing tools
9+
10+
The actions in the `garasign` folder are used to sign artifacts using the team's
11+
GPG key.
12+
13+
### git-sign
14+
15+
Use this action to create signed git artifacts:
16+
```markdown
17+
- name: "Create signed commit"
18+
uses: mongodb/drivers-github-tools/garasign/git-sign@main
19+
with:
20+
command: "git commit -m 'Commit' -s --gpg-sign=${{ vars.GPG_KEY_ID }}"
21+
garasign_username: ${{ secrets.GRS_CONFIG_USER1_USERNAME }}
22+
garasign_password: ${{ secrets.GRS_CONFIG_USER1_PASSWORD }}
23+
artifactory_username: ${{ secrets.ARTIFACTORY_USER }}
24+
artifactory_password: ${{ secrets.ARTIFACTORY_PASSWORD }}
25+
26+
- name: "Create signed tag"
27+
uses: mongodb/drivers-github-tools/garasign/git-sign@main
28+
with:
29+
command: "git tag -m 'Tag' -s --local-user=${{ vars.GPG_KEY_ID }} <tag>"
30+
garasign_username: ${{ secrets.GRS_CONFIG_USER1_USERNAME }}
31+
garasign_password: ${{ secrets.GRS_CONFIG_USER1_PASSWORD }}
32+
artifactory_username: ${{ secrets.ARTIFACTORY_USER }}
33+
artifactory_password: ${{ secrets.ARTIFACTORY_PASSWORD }}
34+
```
35+
36+
If the action is used multiple times within the same job, the `skip_setup`
37+
option can be set to a truthy value to avoid unnecessary logins to artifactory.
38+
39+
### gpg-sign
40+
41+
This action is used to create detached signatures for files:
42+
```markdown
43+
- name: "Create detached signature"
44+
uses: mongodb/drivers-github-tools/garasign/gpg-sign@main
45+
with:
46+
filename: somefile.ext
47+
garasign_username: ${{ secrets.GRS_CONFIG_USER1_USERNAME }}
48+
garasign_password: ${{ secrets.GRS_CONFIG_USER1_PASSWORD }}
49+
artifactory_username: ${{ secrets.ARTIFACTORY_USER }}
50+
artifactory_password: ${{ secrets.ARTIFACTORY_PASSWORD }}
51+
```
52+
53+
The action will create a signature file `somefile.ext.sig` in the working
54+
directory.
55+
If the action is used multiple times within the same job, the `skip_setup`
56+
option can be set to a truthy value to avoid unnecessary logins to artifactory.
57+
58+
### setup
59+
60+
The setup action is used by `git-sign` and `gpg-sign` to create an env file and
61+
sign in to artifactory. It can also be used standalone.

‎garasign/git-sign/action.yml

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: "Sign artifact using garasign"
2+
description: "Signs a release artifact"
3+
inputs:
4+
command:
5+
description: "Command to run inside the container"
6+
required: true
7+
garasign_username:
8+
description: "Garasign username"
9+
required: true
10+
garasign_password:
11+
description: "Garasign password"
12+
required: true
13+
artifactory_username:
14+
description: "Artifactory user"
15+
required: true
16+
artifactory_password:
17+
description: "Artifactory password"
18+
required: true
19+
artifactory_image:
20+
description: "Image to use for artifactory"
21+
default: release-tools-container-registry-local/garasign-git
22+
artifactory_registry:
23+
description: "Artifactory registry to be used"
24+
default: artifactory.corp.mongodb.com
25+
skip_setup:
26+
description: "Whether to skip setup"
27+
default: "false"
28+
29+
runs:
30+
using: composite
31+
steps:
32+
- name: Prepare garasign container
33+
if: ${{ inputs.skip_setup == 'false' }}
34+
uses: ./.github/actions/garasign/setup
35+
with:
36+
garasign_username: ${{ inputs.garasign_username }}
37+
garasign_password: ${{ inputs.garasign_password }}
38+
artifactory_username: ${{ inputs.artifactory_username }}
39+
artifactory_password: ${{ inputs.artifactory_password }}
40+
artifactory_registry: ${{ inputs.artifactory_registry }}
41+
42+
- name: "Run git command"
43+
run: |
44+
podman run \
45+
--env-file=envfile \
46+
--rm \
47+
-v $(pwd):$(pwd) \
48+
-w $(pwd) \
49+
${{ inputs.artifactory_registry }}/${{ inputs.artifactory_image }} \
50+
/bin/bash -c "gpgloader && ${{ inputs.command }}"
51+
shell: bash

‎garasign/gpg-sign/action.yml

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: "Sign artifact using garasign"
2+
description: "Signs a release artifact"
3+
inputs:
4+
filename:
5+
description: "File name to sign"
6+
required: true
7+
garasign_username:
8+
description: "Garasign username"
9+
required: true
10+
garasign_password:
11+
description: "Garasign password"
12+
required: true
13+
artifactory_username:
14+
description: "Artifactory user"
15+
required: true
16+
artifactory_password:
17+
description: "Artifactory password"
18+
required: true
19+
artifactory_image:
20+
description: "Image to use for artifactory"
21+
default: release-tools-container-registry-local/garasign-gpg
22+
artifactory_registry:
23+
description: "Artifactory registry to be used"
24+
default: artifactory.corp.mongodb.com
25+
skip_setup:
26+
description: "Whether to skip setup"
27+
default: "false"
28+
29+
runs:
30+
using: composite
31+
steps:
32+
- name: Prepare garasign container
33+
if: ${{ inputs.skip_setup == 'false' }}
34+
uses: ./.github/actions/garasign/setup
35+
with:
36+
garasign_username: ${{ inputs.garasign_username }}
37+
garasign_password: ${{ inputs.garasign_password }}
38+
artifactory_username: ${{ inputs.artifactory_username }}
39+
artifactory_password: ${{ inputs.artifactory_password }}
40+
artifactory_registry: ${{ inputs.artifactory_registry }}
41+
42+
- name: "Create detached signature"
43+
run: |
44+
podman run \
45+
--env-file=envfile \
46+
--rm \
47+
-v $(pwd):$(pwd) \
48+
-w $(pwd) \
49+
${{ inputs.artifactory_registry }}/${{ inputs.artifactory_image }} \
50+
/bin/bash -c "gpgloader && gpg --detach-sign --armor --output ${{ inputs.filename }}.sig ${{ inputs.filename }}"
51+
shell: bash

‎garasign/setup/action.yml

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: "Prepare garasign container"
2+
description: "Prepares the garasign container used to sign artifacts"
3+
inputs:
4+
garasign_username:
5+
description: "Garasign username"
6+
required: true
7+
garasign_password:
8+
description: "Garasign password"
9+
required: true
10+
artifactory_username:
11+
description: "Artifactory user"
12+
required: true
13+
artifactory_password:
14+
description: "Artifactory password"
15+
required: true
16+
artifactory_registry:
17+
description: "Artifactory registry to be used"
18+
default: artifactory.corp.mongodb.com
19+
20+
runs:
21+
using: composite
22+
steps:
23+
- name: Create the envfile
24+
run: |
25+
cat << EOF > envfile
26+
GRS_CONFIG_USER1_USERNAME=${{ inputs.garasign_username }}
27+
GRS_CONFIG_USER1_PASSWORD=${{ inputs.garasign_password }}
28+
EOF
29+
shell: bash
30+
31+
- name: Log in to artifactory
32+
uses: redhat-actions/podman-login@v1
33+
with:
34+
username: ${{ inputs.artifactory_username }}
35+
password: ${{ inputs.artifactory_password }}
36+
registry: ${{ inputs.artifactory_registry }}

0 commit comments

Comments
 (0)