fix sign workflow

tprasadtp · Apr 15, 2024 · bec0ad3 · bec0ad3
1 parent c6b64f3
commit bec0ad3
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 4 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -11,11 +11,19 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: stable
+
+      - name: Install Task
+        run: go install github.com/go-task/task/v3/cmd/task@latest
+
       - name: Shellcheck
-        run: make shellcheck
+        run: task --verbose shellcheck
 
       - name: Update README
-        run: make update-readme
+        run: task --verbose update-readme
 
       - name: Check if README is up-to date
         run: git diff --exit-code README.md
@@ -94,7 +102,7 @@ jobs:
             echo "failed to get digest"
             exit 1
           fi
-          echo "hash=${digest}" >> "$GITHUB_OUTPUT"
+          echo "digest=${digest}" >> "$GITHUB_OUTPUT"
 
   sign:
     if: github.event_name != 'pull_request'

diff --git a/docs/slsa.md b/docs/slsa.md
@@ -6,7 +6,8 @@ All artifacts provided by this repository meet SLSA-L3.
 
 - Install `slsa-verifier` from [slsa-verifier] project.
 - Get digest of image index/manifest. GHCR UI provides the digest in the UI.
-  alternatively, docker command can be used.
+  alternatively, `docker`, `crane` or `cosign triangulate --type=digest` command
+  can be used.
 
     ```bash
     docker images \