From 6e00c0a814a859b8f1d036e8d5546a3d710cd412 Mon Sep 17 00:00:00 2001 From: Aculix Technologies Date: Sun, 16 Aug 2026 01:39:29 +0530 Subject: [PATCH] ci: publish a clean :latest tag, drop cosign signing The package page showed a sha256 hash instead of a usable tag. cosign pushes a separate artifact per build, tagged sha256-.sig, and because it goes up after the image it was the newest entry. Sixty-odd nightly runs had filled the listing with them. Dropping the signing step leaves :latest visible. The tradeoff is real: published images are no longer signed against the sigstore log. There's no way to keep cosign and hide its artifacts, since GHCR renders them as ordinary versions, so it's signing against a readable package page. Also makes the tagging explicit instead of relying on the action default. latest=auto moves :latest onto any pushed vX.Y.Z tag. Version goes to 2.0.0: storage moved to a new key format, migrated on first open, and Backspace no longer deletes. Removes the analytics tag from index.html. --- .github/workflows/docker-publish.yml | 32 +++++----------------------- package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 8 insertions(+), 30 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 5ae57dd..6035887 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -27,9 +27,6 @@ jobs: permissions: contents: read packages: write - # This is used to complete the identity challenge - # with sigstore/fulcio when running outside of PRs. - id-token: write steps: - name: Checkout repository @@ -39,14 +36,6 @@ jobs: - name: Set up QEMU uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0 - # Install the cosign tool except on PR - # https://github.com/sigstore/cosign-installer - - name: Install cosign - if: github.event_name != 'pull_request' - uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0 - with: - cosign-release: 'v2.2.4' - # Set up BuildKit Docker container builder to be able to build # multi-platform images and export cache # https://github.com/docker/setup-buildx-action @@ -70,13 +59,17 @@ jobs: uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + # latest=auto also moves :latest onto any pushed vX.Y.Z tag, so the + # tag people actually pull tracks the newest release as well as main. + flavor: | + latest=auto tags: | + type=raw,value=latest,enable={{is_default_branch}} type=ref,event=branch type=ref,event=pr type=semver,pattern={{version}} type=semver,pattern={{major}}.{{minor}} type=semver,pattern={{major}} - type=raw,value=latest,enable={{is_default_branch}} # Build and push Docker image with Buildx (don't push on PR) # https://github.com/docker/build-push-action @@ -91,18 +84,3 @@ jobs: labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max - - # Sign the resulting Docker image digest except on PRs. - # This will only write to the public Rekor transparency log when the Docker - # repository is public to avoid leaking data. If you would like to publish - # transparency data even for private images, pass --force to cosign below. - # https://github.com/sigstore/cosign - - name: Sign the published Docker image - if: ${{ github.event_name != 'pull_request' }} - env: - # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable - TAGS: ${{ steps.meta.outputs.tags }} - DIGEST: ${{ steps.build-and-push.outputs.digest }} - # This step uses the identity token to provision an ephemeral certificate - # against the sigstore community Fulcio instance. - run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} diff --git a/package-lock.json b/package-lock.json index 9188f00..b276591 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "negotium-todo", - "version": "1.0.0", + "version": "2.0.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "negotium-todo", - "version": "1.0.0", + "version": "2.0.0", "license": "MIT", "devDependencies": { "@sveltejs/vite-plugin-svelte": "^7.3.0", diff --git a/package.json b/package.json index 61906f3..dceb26b 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "negotium-todo", - "version": "1.0.0", + "version": "2.0.0", "description": "A clean, minimal to-do list application with smooth animations and dark/light mode support", "type": "module", "main": "index.html",