Merge branch 'master' into tag-stable-optional

.github/workflows/release.yaml

@@ -121,6 +121,7 @@ jobs:
       - name: Generate release artifacts
         run: |
           make release-plugins
+          make checksums
           make manifests IMAGE_TAG=${{ github.event.inputs.tag }}
 
       - name: Generate SBOM (spdx)
@@ -188,8 +189,9 @@ jobs:
 
       - name: Sign checksums and create public key for release assets
         run: |
-          cosign sign-blob --key env://COSIGN_PRIVATE_KEY dist/argo-rollouts-checksums.txt > dist/argo-rollouts-checksums.sig
+          cosign sign-blob --key env://COSIGN_PRIVATE_KEY ./dist/argo-rollouts-checksums.txt > ./dist/argo-rollouts-checksums.sig
           cosign public-key --key env://COSIGN_PRIVATE_KEY > ./dist/argo-rollouts-cosign.pub
+          cosign sign-blob --key env://COSIGN_PRIVATE_KEY /tmp/sbom.tar.gz > /tmp/sbom.tar.gz.sig
           # Displays the public key to share.
           cosign public-key --key env://COSIGN_PRIVATE_KEY
         env:
@@ -222,5 +224,6 @@ jobs:
             manifests/notifications-install.yaml
             docs/features/kustomize/rollout_cr_schema.json
             /tmp/sbom.tar.gz
+            /tmp/sbom.tar.gz.sig
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Makefile

@@ -275,3 +275,7 @@ release: release-precheck precheckin image plugin-image release-plugins
 trivy:
 	@trivy fs --clear-cache
 	@trivy fs .
+
+.PHONY: checksums
+checksums:
+	shasum -a 256 ./dist/kubectl-argo-rollouts-* | awk -F './dist/' '{print $$1 $$2}' > ./dist/argo-rollouts-checksums.txt

hack/build-release-plugins.sh

@@ -17,6 +17,3 @@ done
 
 docker rm -v ${container_id}
 rm -f ${rollout_iid_file}
-
-cd ${SRCROOT}/dist/
-shasum -a 256 kubectl-argo-rollouts-* > argo-rollouts-checksums.txt