Screw SBOM, all my homies use SBOM on Harbor.

Author: tvanerven

.github/workflows/docker-image.yml

@@ -17,19 +17,8 @@ jobs:
         username: ${{ secrets.HARBOR_USERNAME }}
         password: ${{ secrets.HARBOR_PASSWORD }}
 
-    - name: Create Python SBOM
-      run: |
-        python -m pip install --upgrade pip
-        sudo npm install -g @cyclonedx/cdxgen
-        pip install -r requirements.txt
-        cdxgen -t python -o sbom.json .
-
-    - name: Install cosign
-      run: |
-        curl -sSfL https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 \
-          -o cosign
-        chmod +x cosign
-        sudo mv cosign /usr/local/bin/
+    - name: Install Cosign
+      uses: sigstore/cosign-installer@v3.9.2
 
     - name: Install oras
       uses: oras-project/setup-oras@v1
@@ -43,23 +32,18 @@ jobs:
         docker push harbor.wizardtower.dev/museit/museit-docs:latest
         docker push harbor.wizardtower.dev/museit/museit-docs:$GITHUB_SHA
 
-    - name: Push SBOM to Harbor
-      run: |
-        oras push harbor.wizardtower.dev/museit/museit-docs/sbom:latest \
-          --manifest-config sbom-python.json:application/json \
-          sbom-python.json:application/json
-        oras push harbor.wizardtower.dev/museit/museit-docs/sbom:$GITHUB_SHA \
-          --manifest-config sbom-python.json:application/json \
-          sbom-python.json:application/json
-
-    - name: Sign SBOM with Cosign
+    - name: Sign images with Cosign
       env:
-        COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+        COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
       run: |
-        echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > cosign.key
         cosign sign \
-          --key cosign.key \
-          harbor.wizardtower.dev/museit/museit-docs/sbom:$GITHUB_SHA
+          --yes \
+          --key env://COSIGN_PRIVATE_KEY \
+          harbor.wizardtower.dev/museit/museit-docs:latest
+        cosign sign \
+          --yes \
+          --key env://COSIGN_PRIVATE_KEY \
+          harbor.wizardtower.dev/museit/museit-docs:$GITHUB_SHA
 
   deploy:
     runs-on: [ self-hosted, linux, rke2, wizardtower ]