sigstore-verification 0.2.8

Sigstore, Cosign, and SLSA attestation verification library
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

name: Test

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

env:
  CARGO_TERM_COLOR: always

jobs:
  test:
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        rust: [stable, beta, nightly]

    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

    - name: Install Rust
      uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
      with:
        toolchain: ${{ matrix.rust }}
        components: rustfmt, clippy

    - name: Cache Rust dependencies
      uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
      with:
        cache-on-failure: true
        save-if: always

    - name: Install mise
      uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4

    - name: Run CI checks
      run: mise run ci


  semver-checks:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

    - name: Check semver compatibility
      uses: obi1kenobi/cargo-semver-checks-action@6b69fcf40e9b5fb17adeb57e4b6ecd020649a239 # v2

  security-audit:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

    - name: Generate Cargo.lock
      run: cargo generate-lockfile

    - name: Security audit
      uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
      with:
        token: ${{ secrets.GITHUB_TOKEN }}