action.yml

name: 'Kernel Signer'
author: 'EyeCantCU'
description: 'Signs kernel in image via Podman'
inputs:
  image:
    description: 'Image containing kernel'
    required: true
  default-tag:
    description: 'Default tag used by container'
    default: 'latest'
    required: true
  kernel_suffix:
    description: 'Allows passing a custom kernel suffix. Only use if kernel package name has been changed'
    required: false
  privkey:
    description: 'Private key, path to private key, or URL to retrieve private key'
    default: '/etc/pki/kernel/private/private_key.priv'
    required: true
  pubkey:
    description: 'Public key, path to public key, or URL to retrieve public key'
    default: '/etc/pki/kernel/public/public_key.der'
    required: true
  repository:
    description: 'Repository containing image'
    default: 'localhost'
    required: true
  tags:
    description: 'Tags used by container'
    default: 'latest'
    required: true
  strip:
    description: 'Whether or not to strip existing secure boot keys from the kernel'
    default: 'true'
    required: false
runs:
  using: "composite"
  steps:
    - name: Sign kernel
      shell: bash
      run: |
        CONTAINER_ID=$(podman run --pull missing --entrypoint /bin/bash --replace --name $(basename "${{ inputs.image }}") -dt "${{ inputs.repository }}/${{ inputs.image }}:${{ inputs.default-tag }}")
        podman cp "${{ github.action_path }}"/sign-kernel.sh $(basename "${{ inputs.image }}"):/tmp/sign-kernel.sh
        podman exec -e KERNEL_SUFFIX="${{ inputs.kernel_suffix }}" -e PRIVKEY="${{ inputs.privkey }}" -e PUBKEY="${{ inputs.pubkey }}" -e STRIP="${{ inputs.strip }}" $(basename "${{ inputs.image }}") "/tmp/sign-kernel.sh"
        buildah commit "$CONTAINER_ID" "${{ inputs.image }}"
        for TAG in $TAGS; do
          echo "Tagging ${{ inputs.image }} with tag: $TAG"
          buildah tag "${{ inputs.image }}" "${{ inputs.image }}":$TAG
        done
      env:
        TAGS: ${{ inputs.tags }}