From 8eeb62a4515f1c4111ee3ae4b5c55827ca5fba64 Mon Sep 17 00:00:00 2001 From: github-actions Date: Tue, 1 Aug 2023 15:34:54 -0500 Subject: [PATCH] Add tuf signing logic back Signed-off-by: github-actions --- .github/workflows/tuf.yml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 .github/workflows/tuf.yml diff --git a/.github/workflows/tuf.yml b/.github/workflows/tuf.yml new file mode 100644 index 00000000..8596a07d --- /dev/null +++ b/.github/workflows/tuf.yml @@ -0,0 +1,30 @@ +name: Sign TUF metadata +on: + schedule: + # every 4 hours + - cron: '0 */4 * * *' + workflow_dispatch: + branches: [ main ] + +jobs: + resign: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v3 + with: + ref: tuf + - name: Setup signing keys + env: + SNAPSHOT_JSON: ${{ secrets.TUF_SNAPSHOT_JSON }} + TIMESTAMP_JSON: ${{ secrets.TUF_TIMESTAMP_JSON }} + run: | + mkdir keys + echo "$SNAPSHOT_JSON" > keys/snapshot.json + echo "$TIMESTAMP_JSON" > keys/timestamp.json + - name: Sign + env: + TUF_SNAPSHOT_PASSPHRASE: ${{ secrets.TUF_SNAPSHOT_PASSPHRASE}} + TUF_TIMESTAMP_PASSPHRASE: ${{ secrets.TUF_TIMESTAMP_PASSPHRASE}} + run: | + ./refresh-metadata.sh