| name: linux-code-sign | |
| description: Sign Linux artifacts with cosign. | |
| inputs: | |
| target: | |
| description: Target triple for the artifacts to sign. | |
| required: true | |
| artifacts-dir: | |
| description: Absolute path to the directory containing built binaries to sign. | |
| required: true | |
| binaries: | |
| description: Space-delimited binary basenames to sign. | |
| default: "codex codex-responses-api-proxy" | |
| runs: | |
| using: composite | |
| steps: | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0 | |
| - name: Cosign Linux artifacts | |
| shell: bash | |
| env: | |
| ARTIFACTS_DIR: ${{ inputs.artifacts-dir }} | |
| BINARIES: ${{ inputs.binaries }} | |
| COSIGN_EXPERIMENTAL: "1" | |
| COSIGN_YES: "true" | |
| COSIGN_OIDC_CLIENT_ID: "sigstore" | |
| COSIGN_OIDC_ISSUER: "https://oauth2.sigstore.dev/auth" | |
| run: | | |
| set -euo pipefail | |
| dest="$ARTIFACTS_DIR" | |
| if [[ ! -d "$dest" ]]; then | |
| echo "Destination $dest does not exist" | |
| exit 1 | |
| fi | |
| for binary in ${BINARIES}; do | |
| artifact="${dest}/${binary}" | |
| if [[ ! -f "$artifact" ]]; then | |
| echo "Binary $artifact not found" | |
| exit 1 | |
| fi | |
| cosign sign-blob \ | |
| --yes \ | |
| --bundle "${artifact}.sigstore" \ | |
| "$artifact" | |
| done | |