-
Notifications
You must be signed in to change notification settings - Fork 13
Closed
Labels
enhancementNew feature or requestNew feature or request
Description
Description
Hello, right now the inputs
input has to be provided by users. But there is scenarios where projects don't necessarily produce any artifact as part of their releases but they would still like they zip and tar file created by GitHub on every release to be signed.
I imagine that
- name: Sign artifacts
uses: sigstore/gh-action-sigstore-python
with:
release-signing-artifacts: true
could potentially be allowed? Or is this outside the scope of this action and projects are expected to do something like
- name: Create source archive
run: gh release download $RELEASE_TAG --dir release_artifacts
env:
RELEASE_TAG: ${{ github.ref_name }}
- name: Sign artifacts
uses: sigstore/gh-action-sigstore-python
with:
inputs: ./*
working-directory: release_artifacts
- name: Upload signed artifacts on the release
run: gh release upload --clobber $RELEASE_TAG *
env:
RELEASE_TAG: ${{ github.ref_name }}
working-directory: release_artifacts
instead?
Metadata
Metadata
Assignees
Labels
enhancementNew feature or requestNew feature or request