From e5eba1f7dc3619d74f45b09663b830536ff01acf Mon Sep 17 00:00:00 2001
From: Tony <TonyRL@users.noreply.github.com>
Date: Thu, 20 Apr 2023 09:32:00 -0500
Subject: [PATCH] chore: signed release (#12355)

* chore: signed release

* fix: use single quotes
---
 .env.me                              | 12 ------------
 .github/workflows/docker-release.yml | 23 +++++++++++++++++++----
 .github/workflows/docker-test.yml    |  1 -
 .github/workflows/npm-publish.yml    |  2 +-
 4 files changed, 20 insertions(+), 18 deletions(-)
 delete mode 100644 .env.me

diff --git a/.env.me b/.env.me
deleted file mode 100644
index 61dafba64..000000000
--- a/.env.me
+++ /dev/null
@@ -1,12 +0,0 @@
-#################################################################################
-#                                                                               #
-#    This file uniquely authorizes you against this project in dotenv-vault.    #
-#                 Do NOT commit this file to source control.                    #
-#                                                                               #
-#                  Generated with 'npx dotenv-vault login'                      #
-#                                                                               #
-#                  Learn more at https://dotenv.org/env-me                      #
-#                                                                               #
-#################################################################################
-
-DOTENV_ME=me_dfea8212459cca5e918e43aeadaebb4b5324b2e14975c69dcbf54c543a732896
\ No newline at end of file
diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index cb0eedfb5..37ab04033 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -37,10 +37,15 @@ jobs:
     permissions:
       packages: write
       contents: read
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v3
 
+      - name: Install cosign
+        if: github.event_name != 'pull_request'
+        uses: sigstore/cosign-installer@v3
+
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v2
 
@@ -73,6 +78,7 @@ jobs:
           flavor: latest=false
 
       - name: Build and push Docker image (ordinary version)
+        id: build-and-push
         uses: docker/build-push-action@v4
         with:
           context: .
@@ -82,8 +88,12 @@ jobs:
           platforms: linux/amd64,linux/arm/v7,linux/arm64
           cache-from: type=gha,scope=docker-release
           cache-to: type=gha,mode=max,scope=docker-release
-          # cache-from: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/rsshub:buildcache
-          # cache-to: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/rsshub:buildcache,mode=max
+
+      - name: Sign the published Docker image
+        if: ${{ github.event_name != 'pull_request' }}
+        env:
+          COSIGN_EXPERIMENTAL: 'true'
+        run: echo "${{ steps.meta-ordinary.outputs.tags }}" | xargs -I {} cosign sign {}@${{ steps.build-and-push.outputs.digest }}
 
       - name: Extract Docker metadata (Chromium-bundled version)
         id: meta-chromium-bundled
@@ -98,6 +108,7 @@ jobs:
           flavor: latest=false
 
       - name: Build and push Docker image (Chromium-bundled version)
+        id: build-and-push-chromium
         uses: docker/build-push-action@v4
         with:
           context: .
@@ -108,10 +119,14 @@ jobs:
           platforms: linux/amd64,linux/arm/v7,linux/arm64
           cache-from: |
             type=registry,ref=${{ secrets.DOCKER_USERNAME }}/rsshub:chromium-bundled
-          # type=gha,scope=docker-release # not needed, Docker automatically uses local cache from the builder
-          # type=registry,ref=${{ secrets.DOCKER_USERNAME }}/rsshub:buildcache
           cache-to: type=inline,ref=${{ secrets.DOCKER_USERNAME }}/rsshub:chromium-bundled  # inline cache is enough
 
+      - name: Sign the published Docker image
+        if: ${{ github.event_name != 'pull_request' }}
+        env:
+          COSIGN_EXPERIMENTAL: 'true'
+        run: echo "${{ steps.meta-chromium-bundled.outputs.tags }}" | xargs -I {} cosign sign {}@${{ steps.build-and-push-chromium.outputs.digest }}
+
   description:
     runs-on: ubuntu-latest
     needs: check-env
diff --git a/.github/workflows/docker-test.yml b/.github/workflows/docker-test.yml
index d2a9227c3..a3c32b42f 100644
--- a/.github/workflows/docker-test.yml
+++ b/.github/workflows/docker-test.yml
@@ -63,7 +63,6 @@ jobs:
         with:
           actions: 'add-labels'
           token: ${{ secrets.GITHUB_TOKEN }}
-          issue-number: ${{ github.event.issue.number }}
           labels: 'Route Test: Failed'
 
       - name: Test Docker image
diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index e4bf06eb9..0d5912c2c 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -29,6 +29,6 @@ jobs:
           git config --local user.name "GitHub Action"
           npx version-from-git --allow-same-version --template 'master.short'
       - name: Publish to npmjs
-        run: npm publish
+        run: npm publish --provenance --access public
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}