stacklok / toolhive / 32472617314

DEFAULT BRANCH: main
Ran
Jobs 1
Files 892
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 69.236% (+0.01%) from 69.226%
32472617314

push

github

web-flow 
Enable keyless signing for CI skill pushes (#6402)

* Enable keyless signing for CI skill pushes

Release skill pushes have been publishing unsigned artifacts behind a
`--no-sign` stopgap since the keyless signing work started. The signer,
the server-side token plumbing, and the CLI's credential ladder are all
in place now, so the stopgap can go: a bare `thv skill push` picks up the
job's ambient OIDC token and signs against Fulcio and Rekor. That needs
`id-token: write` on both the reusable workflow's job and on releaser's
calling job, since GitHub caps a reusable workflow at what its caller
grants.

Nothing so far proves the resulting signature is one the wider Sigstore
ecosystem accepts, only that ToolHive's own verifier reads it back. Add a
workflow that signs a throwaway skill against Sigstore's staging Fulcio
and Rekor, pushes it to a local registry container, and verifies it with
stock cosign. It runs on every PR and on main, non-blocking: staging has
no SLO guarantee and re-signs its TUF metadata every few days, so its
outages must not gate merges.

Also document the push-then-sign ordering, which leaves an artifact
published but unsigned if signing fails after the upload succeeds.

Signed-off-by: Samuele Verzi <samu@stacklok.com>

* Grant id-token to build-only skills callers

GitHub validates a called workflow's declared permissions against the
calling job's statically, before inputs are evaluated, so the build-only
callers must grant id-token: write even though only the release caller
ever reaches the signing code. Without it the whole PR Checks run fails
at startup rather than the job simply running unprivileged.

Signed-off-by: Samuele Verzi <samu@stacklok.com>

* Anchor the keyless E2E certificate identity match

sigstore-go tests the certificate SAN with Regexp.MatchString, which is
unanchored, so the previous pattern accepted any SAN merely containing the
expected workflow identity. Anchor it and escape the literal dots, since
proving ... (continued)

74521 of 107634 relevant lines covered (69.24%)

88.24 hits per line

Coverage Regressions

Lines Coverage ∆ File
30
34.78
 -7.32% cmd/thv/app/skill_push.go
6
72.34
 -6.38% pkg/secrets/keyring/keyctl_linux.go
2
87.5
 -6.25% pkg/vmcp/backendregistry/registry.go
1
94.49
 -0.79% pkg/vmcp/composer/dag_executor.go
Jobs
ID Job ID Ran Files Coverage
1 32472617314.1 892
69.24
 GitHub Action Run
Source Files on build 32472617314