Skip to content

ci: check installer digests before running them #3744

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jiparis merged 1 commit into from
Oct 28, 2026
Merged

ci: check installer digests before running them #3744

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion .github/workflows/author_verification.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,15 @@ jobs:

steps:
- name: Install Chainloop
# The installer is pinned by digest, as in package_sandbox_kit.yaml.
# If dl.chainloop.dev publishes a new installer, re-pin with:
# curl -sfL https://dl.chainloop.dev/cli/install.sh | sha256sum
env:
INSTALLER_SHA256: 6ebcdb8edc6f22c92b6ac31a363f7d60da6e04c60c4fadda44169f18492ba46e
run: |
curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s
curl -sfL https://dl.chainloop.dev/cli/install.sh -o /tmp/chainloop-install.sh
echo "${INSTALLER_SHA256} /tmp/chainloop-install.sh" | sha256sum -c -
bash /tmp/chainloop-install.sh

- name: Checkout repository
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
Expand Down
9 changes: 8 additions & 1 deletion .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,8 +33,15 @@ jobs:
steps:
- name: Install Chainloop
if: ${{ github.event_name != 'pull_request' }}
# The installer is pinned by digest, as in package_sandbox_kit.yaml.
# If dl.chainloop.dev publishes a new installer, re-pin with:
# curl -sfL https://dl.chainloop.dev/cli/install.sh | sha256sum
env:
INSTALLER_SHA256: 6ebcdb8edc6f22c92b6ac31a363f7d60da6e04c60c4fadda44169f18492ba46e
run: |
curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s
curl -sfL https://dl.chainloop.dev/cli/install.sh -o /tmp/chainloop-install.sh
echo "${INSTALLER_SHA256} /tmp/chainloop-install.sh" | sha256sum -c -
bash /tmp/chainloop-install.sh

- name: Checkout repository
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
Expand Down
8 changes: 7 additions & 1 deletion .github/workflows/lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,10 +65,16 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Install Dagger CLI
# The installer is pinned by digest. If dl.dagger.io publishes a new
# installer, re-pin with: curl -sfL https://dl.dagger.io/dagger/install.sh | sha256sum
env:
INSTALLER_SHA256: 2f7d6c4892d22dfb89e3ac226b33d20627aa4ab62cd33ae8dd792588935f673d
run: |
mkdir -p ~/.local/bin
cd ~/.local
curl -L https://dl.dagger.io/dagger/install.sh | DAGGER_VERSION=0.21.10 sh
curl -sfL https://dl.dagger.io/dagger/install.sh -o /tmp/dagger-install.sh
echo "${INSTALLER_SHA256} /tmp/dagger-install.sh" | sha256sum -c -
DAGGER_VERSION=0.21.10 sh /tmp/dagger-install.sh

- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
Expand Down
9 changes: 8 additions & 1 deletion .github/workflows/package_chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,8 +22,15 @@ jobs:
CHAINLOOP_PROJECT: "chainloop"
steps:
- name: Install Chainloop
# The installer is pinned by digest, as in package_sandbox_kit.yaml.
# If dl.chainloop.dev publishes a new installer, re-pin with:
# curl -sfL https://dl.chainloop.dev/cli/install.sh | sha256sum
env:
INSTALLER_SHA256: 6ebcdb8edc6f22c92b6ac31a363f7d60da6e04c60c4fadda44169f18492ba46e
run: |
curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s
curl -sfL https://dl.chainloop.dev/cli/install.sh -o /tmp/chainloop-install.sh
echo "${INSTALLER_SHA256} /tmp/chainloop-install.sh" | sha256sum -c -
bash /tmp/chainloop-install.sh

- name: Docker login to Github Packages
uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
Expand Down
32 changes: 27 additions & 5 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,15 @@ jobs:
persist-credentials: false

- name: Install Chainloop
# The installer is pinned by digest, as in package_sandbox_kit.yaml.
# If dl.chainloop.dev publishes a new installer, re-pin with:
# curl -sfL https://dl.chainloop.dev/cli/install.sh | sha256sum
env:
INSTALLER_SHA256: 6ebcdb8edc6f22c92b6ac31a363f7d60da6e04c60c4fadda44169f18492ba46e
run: |
curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s
curl -sfL https://dl.chainloop.dev/cli/install.sh -o /tmp/chainloop-install.sh
echo "${INSTALLER_SHA256} /tmp/chainloop-install.sh" | sha256sum -c -
bash /tmp/chainloop-install.sh

- name: Run Release Gate Attestation
run: |
Expand Down Expand Up @@ -66,8 +73,15 @@ jobs:
cosign-release: "v2.2.3"

- name: Install Chainloop
# The installer is pinned by digest, as in package_sandbox_kit.yaml.
# If dl.chainloop.dev publishes a new installer, re-pin with:
# curl -sfL https://dl.chainloop.dev/cli/install.sh | sha256sum
env:
INSTALLER_SHA256: 6ebcdb8edc6f22c92b6ac31a363f7d60da6e04c60c4fadda44169f18492ba46e
run: |
curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s
curl -sfL https://dl.chainloop.dev/cli/install.sh -o /tmp/chainloop-install.sh
echo "${INSTALLER_SHA256} /tmp/chainloop-install.sh" | sha256sum -c -
bash /tmp/chainloop-install.sh

- name: Checkout
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
Expand Down Expand Up @@ -104,12 +118,20 @@ jobs:
uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a # v3.3.0

- name: Install Syft
env:
INSTALLER_SHA256: 709ae9171e3d44e456a111943c341d0bf0fd2176b41af124d019823a70c34a3f
run: |
# Install Syft
wget --no-verbose https://raw.githubusercontent.com/anchore/syft/c43f4fb416c34c1c4b3997373689d8d4c0fb9b36/install.sh -O - | sh -s -- -b /usr/local/bin
wget --no-verbose https://raw.githubusercontent.com/anchore/syft/c43f4fb416c34c1c4b3997373689d8d4c0fb9b36/install.sh -O /tmp/syft-install.sh
echo "${INSTALLER_SHA256} /tmp/syft-install.sh" | sha256sum -c -
sh /tmp/syft-install.sh -b /usr/local/bin

- name: Install Grype
run: curl -sSfL https://raw.githubusercontent.com/anchore/grype/fe186c3e986dda3cb4c5e90798f82c52aefcb4b8/install.sh | sh -s -- -b /usr/local/bin
env:
INSTALLER_SHA256: 8646f06a90b10ca64992c1809b4aa00c44e30b4f551f63c309b0b0ab66873556
run: |
curl -sSfL https://raw.githubusercontent.com/anchore/grype/fe186c3e986dda3cb4c5e90798f82c52aefcb4b8/install.sh -o /tmp/grype-install.sh
echo "${INSTALLER_SHA256} /tmp/grype-install.sh" | sha256sum -c -
sh /tmp/grype-install.sh -b /usr/local/bin

- name: Run GoReleaser
id: release
Expand Down
9 changes: 8 additions & 1 deletion .github/workflows/sync_contracts.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,8 +22,15 @@ jobs:
with:
persist-credentials: false
- name: Install Chainloop
# The installer is pinned by digest, as in package_sandbox_kit.yaml.
# If dl.chainloop.dev publishes a new installer, re-pin with:
# curl -sfL https://dl.chainloop.dev/cli/install.sh | sha256sum
env:
INSTALLER_SHA256: 6ebcdb8edc6f22c92b6ac31a363f7d60da6e04c60c4fadda44169f18492ba46e
run: |
curl -sfL https://dl.chainloop.dev/cli/install.sh | bash -s
curl -sfL https://dl.chainloop.dev/cli/install.sh -o /tmp/chainloop-install.sh
echo "${INSTALLER_SHA256} /tmp/chainloop-install.sh" | sha256sum -c -
bash /tmp/chainloop-install.sh
- name: Update contract definitions
run: |
for file in .github/workflows/contracts/*.yaml; do
Expand Down
Loading