workflows: Add a custom smoke test with cosign

sigstore / root-signing-staging

Staging TUF repository for Sigstore trust root

https://tuf-repo-cdn.sigstage.dev/

Apache License 2.0

3 stars 5 forks source link

workflows: Add a custom smoke test with cosign #44

Closed jku closed 4 months ago

jku commented 4 months ago

I don't think testing loads of clients (in this repository) is a good idea but

cosign is important
cosign does not use sigstore-conformance so even adding staging tests there won't help

So let's test cosign right here, at least for now

jku commented 4 months ago

This workflow can't really be tested in this PR (because the OIDC identity is not available in PRs) but I've tested 99% same workflow in a different project: looks good to me.

jku commented 4 months ago

Looks good: https://github.com/sigstore/root-signing-staging/actions/runs/7874985027