--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Commit 4a349216557be40d68c9978a069bd760de5bd36e
Parents : 276eac0
Author : Ivan <ivan@quad4.io>
Signature : Signature validation error
Date : 2026-04-22T13:33:50-05:00
feat(ci): add rekor monitoring workflow and setup script for rekor-cli installation
Changes
3 files changed, 99 insertions(+), 0 deletions(-)
Diff
diff --git a/.gitea/workflows/rekor-monitor.yml b/.gitea/workflows/rekor-monitor.yml
new file mode 100644
index 00000000..7db80cf8
--- /dev/null
+++ b/.gitea/workflows/rekor-monitor.yml
@@ -0,0 +1,37 @@
+name: Rekor tree verification
+
+on:
+ schedule:
+ - cron: "23 11 * * 1"
+ workflow_dispatch:
+
+permissions:
+ contents: read
+
+jobs:
+ rekor-loginfo:
+ runs-on: ubuntu-latest
+ steps:
+ - name: Clone Repo
+ run: |
+ set -eu
+ SERVER="${GITEA_SERVER_URL:-${GITHUB_SERVER_URL:-}}"
+ REPO="${GITEA_REPOSITORY:-${GITHUB_REPOSITORY:-}}"
+ if [ -z "$SERVER" ] || [ -z "$REPO" ]; then
+ echo "Checkout: set GITEA_SERVER_URL/GITEA_REPOSITORY or GITHUB_SERVER_URL/GITHUB_REPOSITORY" >&2
+ exit 1
+ fi
+ if [ -n "${GITEA_TOKEN:-}" ] || [ -n "${GITHUB_TOKEN:-}" ]; then
+ TOKEN="${GITEA_TOKEN:-$GITHUB_TOKEN}"
+ git config --global credential.helper "!f() { echo username=x-access-token; echo password=${TOKEN}; }; f"
+ fi
+ git init -q && git remote add origin "${SERVER}/${REPO}.git"
+ git fetch -q --depth=1 origin "${GITHUB_SHA}" && git checkout -q FETCH_HEAD
+
+ - name: Install rekor-cli
+ run: sh scripts/ci/setup-rekor-cli.sh
+
+ - name: Verify Rekor signed tree head
+ run: |
+ set -eu
+ rekor-cli loginfo --rekor_server "${REKOR_SERVER:-https://rekor.sigstore.dev}" --store_tree_state=false
diff --git a/.github/workflows/rekor-monitor.yml b/.github/workflows/rekor-monitor.yml
new file mode 100644
index 00000000..e9ea8a09
--- /dev/null
+++ b/.github/workflows/rekor-monitor.yml
@@ -0,0 +1,24 @@
+# Cross-run Rekor checkpoint persistence uses Sigstore's reusable workflow (Actions artifact).
+name: Rekor log monitor
+
+on:
+ schedule:
+ - cron: "17 11 * * 1"
+ workflow_dispatch:
+
+concurrency:
+ group: rekor-monitor
+ cancel-in-progress: false
+
+permissions:
+ contents: read
+ id-token: write
+ issues: write
+
+jobs:
+ rekor:
+ uses: sigstore/rekor-monitor/.github/workflows/reusable_monitoring.yml@01680ec70d6bfa0ee4487f9be605c2db13273963
+ secrets: inherit
+ with:
+ file_issue: false
+ artifact_retention_days: 30
diff --git a/scripts/ci/setup-rekor-cli.sh b/scripts/ci/setup-rekor-cli.sh
new file mode 100755
index 00000000..6551eb61
--- /dev/null
+++ b/scripts/ci/setup-rekor-cli.sh
@@ -0,0 +1,38 @@
+#!/bin/sh
+# Install rekor-cli from GitHub releases with SHA256 verification.
+# Usage: setup-rekor-cli.sh [version]
+set -eu
+
+. "$(dirname "$0")/priv.sh"
+
+REKOR_VERSION="${1:-1.5.1}"
+
+ARCH="$(uname -m)"
+case "$ARCH" in
+ x86_64)
+ BINARY="rekor-cli-linux-amd64"
+ EXPECTED_SHA256="0b4964af85477892c37039fb80793b151864970d19838873eaa1a777ca2fb813"
+ ;;
+ aarch64)
+ BINARY="rekor-cli-linux-arm64"
+ EXPECTED_SHA256="6417ea36bea9239125ec21e73c5d9b5e7e837b580cfdfea1e47e04bb02235534"
+ ;;
+ *)
+ echo "Unsupported architecture: $ARCH" >&2
+ exit 1
+ ;;
+esac
+
+BASE_URL="https://github.com/sigstore/rekor/releases/download/v${REKOR_VERSION}"
+curl -fsSL "${BASE_URL}/${BINARY}" -o /tmp/rekor-cli
+
+ACTUAL="$(sha256sum /tmp/rekor-cli | awk '{print $1}')"
+if [ "$EXPECTED_SHA256" != "$ACTUAL" ]; then
+ echo "SHA256 verification failed for ${BINARY}" >&2
+ rm -f /tmp/rekor-cli
+ exit 1
+fi
+
+run_priv install -m 0755 /tmp/rekor-cli /usr/local/bin/rekor-cli
+rm -f /tmp/rekor-cli
+rekor-cli version
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────