82f3140847
Complete architecture document set with multi-model review remediation: - Frozen interface contracts, runtime semantics, DB schemas - Event/tool/error/provider registries - Scheduler and main agent state machines - C4 module/code views, solution architecture, baseline V1 - Multi-model review reports and joint assessment - Phase-gate remediation complete (P0/P1/P2/UX resolved) - Implementation plan with T-000A through T-045 - Reference folders kept as placeholders only
50 lines
1.4 KiB
YAML
50 lines
1.4 KiB
YAML
name: linux-code-sign
|
|
description: Sign Linux artifacts with cosign.
|
|
inputs:
|
|
target:
|
|
description: Target triple for the artifacts to sign.
|
|
required: true
|
|
artifacts-dir:
|
|
description: Absolute path to the directory containing built binaries to sign.
|
|
required: true
|
|
binaries:
|
|
description: Space-delimited binary basenames to sign.
|
|
default: "codex codex-responses-api-proxy"
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Install cosign
|
|
uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
|
|
|
|
- name: Cosign Linux artifacts
|
|
shell: bash
|
|
env:
|
|
ARTIFACTS_DIR: ${{ inputs.artifacts-dir }}
|
|
BINARIES: ${{ inputs.binaries }}
|
|
COSIGN_EXPERIMENTAL: "1"
|
|
COSIGN_YES: "true"
|
|
COSIGN_OIDC_CLIENT_ID: "sigstore"
|
|
COSIGN_OIDC_ISSUER: "https://oauth2.sigstore.dev/auth"
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
dest="$ARTIFACTS_DIR"
|
|
if [[ ! -d "$dest" ]]; then
|
|
echo "Destination $dest does not exist"
|
|
exit 1
|
|
fi
|
|
|
|
for binary in ${BINARIES}; do
|
|
artifact="${dest}/${binary}"
|
|
if [[ ! -f "$artifact" ]]; then
|
|
echo "Binary $artifact not found"
|
|
exit 1
|
|
fi
|
|
|
|
cosign sign-blob \
|
|
--yes \
|
|
--bundle "${artifact}.sigstore" \
|
|
"$artifact"
|
|
done
|