配置 GitHub 操作

Red Hat Advanced Developer Suite - software supply chain 1.7

了解如何为安全 CI/CD 工作流配置 GitHub 操作。

Red Hat Advanced Developer Suite - software supply chain Documentation Team

摘要

本文档提供了有关设置 GitHub Actions 以执行基本安全任务的说明，如漏洞扫描、镜像签名和测试生成。

前言
复制链接

如果您在应用程序中使用 GitHub Actions，则管道运行可能会因为缺少 secret 而失败。如果没有它们，与 Quay、JFrog Artifactory、Ssonatype Nexus 存储库和 Red Hat Advanced Cluster Security (ACS)的集成将无法正常工作、破坏安全任务，如漏洞扫描、镜像签名和 SBOM 生成合规性。

要防止这种情况，您需要在 GitHub Actions 中安全地存储 secret。本指南指导您完成这个过程，确保管道平稳运行。

第 1 章在 GitHub Actions 中添加用于与外部工具集成的 secret 和变量
复制链接

先决条件

在配置 GitHub Actions 前，请确定您有以下内容：

对 GitHub 存储库和 CI/CD 设置的管理员访问权限。
用于从 Quay、JFrog Artifactory 或 Sonatype Nexus Repository 中拉取容器镜像的 容器注册表凭证。
特定 GitHub Actions 任务的 身份验证详情 ：
- 对于 ACS 安全任务 ：
  - ROX Central 服务器端点
  - ROX API 令牌
- 对于 SBOM 和工件签名任务 ：
  - Cosign 签名密钥密码、私钥和公钥
  - Trustification API 和 issuer URL, client ID, client secret, and supported CycloneDX version
注意
凭证和其他详情已经经过 Base64 编码，因此您不需要再次编码它们。您可以在 RHADS - SSC 安装过程中创建的 private.env 文件中找到这些凭证。

1.1. 选项 1：使用 UI 将 secret 和变量添加到 GitHub Actions
复制链接

流程

登录 GitHub 并导航到您的源存储库。
转至 Settings 选项卡。
在左侧导航窗格中，选择 Secrets 和 variables，然后选择 Actions。
在 Actions secret 和 variables 页面中，选择 Secrets 选项卡。
1. 选择 New repository secret。
2. 在 Name 和 Secret 字段中添加值。
3. 选择 Add secret。

重复步骤 4 以添加所需的 secret：

Expand

表 1.1. 镜像 registry 和 GitOps secret
变量	描述
`IMAGE_REGISTRY_PASSWORD`	用于访问容器镜像 registry 的密码。
`GITOPS_AUTH_PASSWORD`	系统用来为新构建镜像更新 GitOps 存储库的令牌。

Expand

表 1.2. ACS 和 SBOM 任务所需的 secret
变量	描述
`ROX_API_TOKEN`	用于访问 ROX 服务器的 API 令牌。
`COSIGN_SECRET_PASSWORD`	Cosign 签名密钥的密码。
`COSIGN_SECRET_KEY`	Cosign 的私钥。
`TRUSTIFICATION_OIDC_CLIENT_SECRET`	与客户端 ID 一起使用的客户端 secret，以向 Trustification Bombastic API 进行身份验证。

在 Actions secret 和 variables 页面中，切换到 Variables 选项卡。
1. 选择 New repository variable。
2. 在 Name 和 Value 字段中添加值。
3. 选择 添加变量。

重复步骤 6 以添加所需的变量：

Expand

表 1.3. 镜像 registry 变量
变量	描述
`IMAGE_REGISTRY_USER`	用于访问容器镜像 registry 的用户名。

Expand

表 1.4. ACS 和 SBOM 任务所需的变量
变量	描述
`ROX_CENTRAL_ENDPOINT`	ROX Central 服务器的端点。
`COSIGN_PUBLIC_KEY`	Cosign 的公钥。
`TRUSTIFICATION_BOMBASTIC_API_URL`	SBOM 生成中使用的 Trustification Bombastic API 的 URL。
`TRUSTIFICATION_OIDC_ISSUER_URL`	与 Trustification Bombastic API 交互时用于身份验证的 OIDC 签发者 URL。
`TRUSTIFICATION_OIDC_CLIENT_ID`	用于使用 OIDC 向 Trustification Bombastic API 进行身份验证的客户端 ID。
`TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION`	指定系统支持并生成的 CycloneDX SBOM 版本。

可选：如果您的 CI 供应商运行程序没有在与 RHADS - SSC 实例相同的集群中运行，则设置 Rekor 和 TUF 变量。

Expand

表 1.5. Rekor 和 TUF 变量
变量	描述
`REKOR_HOST`	您的 Rekor 服务器的 URL。
`TUF_MIRROR`	您的 TUF 服务的 URL。

重新运行最后的管道运行，以验证 secret 是否已正确应用。
1. 或者，切换到 GitHub 中应用的源存储库，进行次要更改，并提交它以触发新的管道运行。

1.2. 选项 2：使用 CLI 将 secret 和变量添加到 GitHub Actions
复制链接

流程

在首选文本编辑器中使用两个文件创建项目，如 Visual Studio Code：
- env_vars.sh
- ghub-set-vars

使用以下环境变量更新 env_vars.sh 文件：

env_vars.sh
export GITOPS_AUTH_PASSWORD="your_github_token_here"

# Image registry variables
export IMAGE_REGISTRY_USER="your_registry_username_here"
export IMAGE_REGISTRY_PASSWORD="your_registry_password_here"

// Add credentials for an image repository that you use
# Quay.io credentials
export QUAY_IO_CREDS_USR="your_quay_username_here"
export QUAY_IO_CREDS_PSW="your_quay_password_here"

or JFrog Artifactory credenditals
export ARTIFACTORY_IO_CREDS_USR="your_artifactory_username_here"
export ARTIFACTORY_IO_CREDS_PSW="your_artifactory_password_here"

or Sonatype Nexus credentials
export NEXUS_IO_CREDS_USR="your_nexus_username_here"
export NEXUS_IO_CREDS_PSW="your_nexus_password_here"

// Variables required for ACS tasks
# ROX variables
export ROX_CENTRAL_ENDPOINT="your_rox_central_endpoint_here"
export ROX_API_TOKEN="your_rox_api_token_here"

// Variables required for SBOM tasks.
# Cosign secrets
export COSIGN_SECRET_PASSWORD="your_cosign_secret_password_here"
export COSIGN_SECRET_KEY="your_cosign_secret_key_here"
export COSIGN_PUBLIC_KEY="your_cosign_public_key_here"

# Trustification credentials
export TRUSTIFICATION_BOMBASTIC_API_URL="your__BOMBASTIC_API_URL_here"
export TRUSTIFICATION_OIDC_ISSUER_URL="your_OIDC_ISSUER_URL_here"
export TRUSTIFICATION_OIDC_CLIENT_ID="your_OIDC_CLIENT_ID_here"
export TRUSTIFICATION_OIDC_CLIENT_SECRET="your_OIDC_CLIENT_SECRET_here"
export TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION="your_SUPPORTED_CYCLONEDX_VERSION_here"

// Set these variables if your CI provider runners do not run
on the same cluster as the {ProductShortName} instance.
# Rekor and TUF routes
export REKOR_HOST="your rekor server url here"
export TUF_MIRROR="your tuf service url here"

# env_vars.sh
export GITOPS_AUTH_PASSWORD="your_github_token_here"

# Image registry variables
export IMAGE_REGISTRY_USER="your_registry_username_here"
export IMAGE_REGISTRY_PASSWORD="your_registry_password_here"

// Add credentials for an image repository that you use
# Quay.io credentials
export QUAY_IO_CREDS_USR="your_quay_username_here"
export QUAY_IO_CREDS_PSW="your_quay_password_here"

# or JFrog Artifactory credenditals
export ARTIFACTORY_IO_CREDS_USR="your_artifactory_username_here"
export ARTIFACTORY_IO_CREDS_PSW="your_artifactory_password_here"

# or Sonatype Nexus credentials
export NEXUS_IO_CREDS_USR="your_nexus_username_here"
export NEXUS_IO_CREDS_PSW="your_nexus_password_here"

// Variables required for ACS tasks
# ROX variables
export ROX_CENTRAL_ENDPOINT="your_rox_central_endpoint_here"
export ROX_API_TOKEN="your_rox_api_token_here"

// Variables required for SBOM tasks.
# Cosign secrets
export COSIGN_SECRET_PASSWORD="your_cosign_secret_password_here"
export COSIGN_SECRET_KEY="your_cosign_secret_key_here"
export COSIGN_PUBLIC_KEY="your_cosign_public_key_here"

# Trustification credentials
export TRUSTIFICATION_BOMBASTIC_API_URL="your__BOMBASTIC_API_URL_here"
export TRUSTIFICATION_OIDC_ISSUER_URL="your_OIDC_ISSUER_URL_here"
export TRUSTIFICATION_OIDC_CLIENT_ID="your_OIDC_CLIENT_ID_here"
export TRUSTIFICATION_OIDC_CLIENT_SECRET="your_OIDC_CLIENT_SECRET_here"
export TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION="your_SUPPORTED_CYCLONEDX_VERSION_here"

// Set these variables if your CI provider runners do not run
on the same cluster as the {ProductShortName} instance.
# Rekor and TUF routes
export REKOR_HOST="your rekor server url here"
export TUF_MIRROR="your tuf service url here"

Copy to Clipboard

Toggle word wrap

使用以下信息更新 ghub-set-vars 文件：

#!/bin/bash

# Helper script used to simplify setting variables and secrets in a GitHub repository

set -euo pipefail

function echo_usage() {
    echo "Usage: $0 OWNER/REPO"
    echo "       $0 https://github.com/OWNER/REPO"
}

if [ $# -ne 1 ]; then
    echo "Invalid number of arguments"
    echo
    echo_usage
    exit 1
fi

github_repository=$1

# Naive check that the provided repository in the argument matches
the expected format (see usage)
if ! [[ "$github_repository" =~ ^(https://github.com/)?(.+/.+)$ ]]; then
    echo "Invalid format of the provided argument '${github_repository}'"
    echo
    echo_usage
fi

# Set repository variable via GitHub CLI
# The value of the variable will NOT be hidden in the logs
function set_variable() {
    echo "Setting variable '$1' in $github_repository..."
    gh variable set "$1" --body "$2" --repo "$github_repository"
}

# Set repository secret via GitHub CLI
function set_secret() {
    echo "Setting secret '$1' in $github_repository..."
    gh secret set "$1" --body "$2" --repo "$github_repository"
}

# Set the minimum required variables and secrets

# Depending on which image repository you use, set:
set_variable IMAGE_REGISTRY quay.io/"$QUAY_IO_CREDS_USR"
set_variable IMAGE_REGISTRY_USER "$QUAY_IO_CREDS_USR"
set_secret IMAGE_REGISTRY_PASSWORD "$QUAY_IO_CREDS_PSW"
or
set_variable IMAGE_REGISTRY_USER "$ARTIFACTORY_IO_CREDS_USR"
set_secret IMAGE_REGISTRY_PASSWORD "$ARTIFACTORY_IO_CREDS_PSW"
or
set_variable IMAGE_REGISTRY_USER "$NEXUS_IO_CREDS_USR"
set_secret IMAGE_REGISTRY_PASSWORD "$NEXUS_IO_CREDS_PSW"

set_variable ROX_CENTRAL_ENDPOINT "$ROX_CENTRAL_ENDPOINT"
set_secret ROX_API_TOKEN "$ROX_API_TOKEN"

set_secret GITOPS_AUTH_PASSWORD "$GITOPS_AUTH_PASSWORD"

set_variable QUAY_IO_CREDS_USR "$QUAY_IO_CREDS_USR"
set_secret QUAY_IO_CREDS_PSW "$QUAY_IO_CREDS_PSW"

set_secret COSIGN_SECRET_PASSWORD "$COSIGN_SECRET_PASSWORD"
set_secret COSIGN_SECRET_KEY "$COSIGN_SECRET_KEY"
set_variable COSIGN_PUBLIC_KEY "$COSIGN_PUBLIC_KEY"

set_variable TRUSTIFICATION_BOMBASTIC_API_URL "$TRUSTIFICATION_BOMBASTIC_API_URL"
set_variable TRUSTIFICATION_OIDC_ISSUER_URL "$TRUSTIFICATION_OIDC_ISSUER_URL"
set_variable TRUSTIFICATION_OIDC_CLIENT_ID "$TRUSTIFICATION_OIDC_CLIENT_ID"
set_variable TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION "$TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION"
set_secret TRUSTIFICATION_OIDC_CLIENT_SECRET "$TRUSTIFICATION_OIDC_CLIENT_SECRET"

# If you need to use the Rekor and TUF variables and you've added them to env_vars.sh,
set them here too:
set_variable REKOR_HOST "$REKOR_HOST"
set_variable TUF_MIRROR "$TUF_MIRROR"

echo
echo "All variables and secrets are set."

#!/bin/bash

# Helper script used to simplify setting variables and secrets in a GitHub repository

set -euo pipefail

function echo_usage() {
    echo "Usage: $0 OWNER/REPO"
    echo "       $0 https://github.com/OWNER/REPO"
}

if [ $# -ne 1 ]; then
    echo "Invalid number of arguments"
    echo
    echo_usage
    exit 1
fi

github_repository=$1

# Naive check that the provided repository in the argument matches
# the expected format (see usage)
if ! [[ "$github_repository" =~ ^(https://github.com/)?(.+/.+)$ ]]; then
    echo "Invalid format of the provided argument '${github_repository}'"
    echo
    echo_usage
fi

# Set repository variable via GitHub CLI
# The value of the variable will NOT be hidden in the logs
function set_variable() {
    echo "Setting variable '$1' in $github_repository..."
    gh variable set "$1" --body "$2" --repo "$github_repository"
}

# Set repository secret via GitHub CLI
function set_secret() {
    echo "Setting secret '$1' in $github_repository..."
    gh secret set "$1" --body "$2" --repo "$github_repository"
}

# Set the minimum required variables and secrets

# Depending on which image repository you use, set:
set_variable IMAGE_REGISTRY quay.io/"$QUAY_IO_CREDS_USR"
set_variable IMAGE_REGISTRY_USER "$QUAY_IO_CREDS_USR"
set_secret IMAGE_REGISTRY_PASSWORD "$QUAY_IO_CREDS_PSW"
# or
set_variable IMAGE_REGISTRY_USER "$ARTIFACTORY_IO_CREDS_USR"
set_secret IMAGE_REGISTRY_PASSWORD "$ARTIFACTORY_IO_CREDS_PSW"
# or
set_variable IMAGE_REGISTRY_USER "$NEXUS_IO_CREDS_USR"
set_secret IMAGE_REGISTRY_PASSWORD "$NEXUS_IO_CREDS_PSW"

set_variable ROX_CENTRAL_ENDPOINT "$ROX_CENTRAL_ENDPOINT"
set_secret ROX_API_TOKEN "$ROX_API_TOKEN"

set_secret GITOPS_AUTH_PASSWORD "$GITOPS_AUTH_PASSWORD"

set_variable QUAY_IO_CREDS_USR "$QUAY_IO_CREDS_USR"
set_secret QUAY_IO_CREDS_PSW "$QUAY_IO_CREDS_PSW"

set_secret COSIGN_SECRET_PASSWORD "$COSIGN_SECRET_PASSWORD"
set_secret COSIGN_SECRET_KEY "$COSIGN_SECRET_KEY"
set_variable COSIGN_PUBLIC_KEY "$COSIGN_PUBLIC_KEY"

set_variable TRUSTIFICATION_BOMBASTIC_API_URL "$TRUSTIFICATION_BOMBASTIC_API_URL"
set_variable TRUSTIFICATION_OIDC_ISSUER_URL "$TRUSTIFICATION_OIDC_ISSUER_URL"
set_variable TRUSTIFICATION_OIDC_CLIENT_ID "$TRUSTIFICATION_OIDC_CLIENT_ID"
set_variable TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION "$TRUSTIFICATION_SUPPORTED_CYCLONEDX_VERSION"
set_secret TRUSTIFICATION_OIDC_CLIENT_SECRET "$TRUSTIFICATION_OIDC_CLIENT_SECRET"

# If you need to use the Rekor and TUF variables and you've added them to env_vars.sh,
# set them here too:
set_variable REKOR_HOST "$REKOR_HOST"
set_variable TUF_MIRROR "$TUF_MIRROR"

echo
echo "All variables and secrets are set."

Copy to Clipboard

Toggle word wrap

将环境变量加载到当前 shell 会话中：
```
source env_vars.sh
```
```
source env_vars.sh
```
Copy to Clipboard Toggle word wrap
使 ghub-set-vars 脚本可执行，并使用您的存储库名称运行它，以设置 GitHub 存储库中的变量。
```
chmod +x ghub-set-vars

./ghub-set-vars your_repository_name
```
```
chmod +x ghub-set-vars

./ghub-set-vars your_repository_name
```
Copy to Clipboard Toggle word wrap
重新运行最后的管道运行，以验证 secret 是否已正确应用。
1. 或者，切换到 GitHub 中应用的源存储库，进行次要更改，并提交它以触发新的管道运行。

更新于 2025-09-07

法律通告
复制链接

The text of and illustrations in this document are licensed by Red Hat under a Creative Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available at http://creativecommons.org/licenses/by-sa/3.0/. In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must provide the URL for the original version.

Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law.

Red Hat, Red Hat Enterprise Linux, the Shadowman logo, the Red Hat logo, JBoss, OpenShift, Fedora, the Infinity logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries.

Linux® is the registered trademark of Linus Torvalds in the United States and other countries.

Java® is a registered trademark of Oracle and/or its affiliates.

XFS® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries.

MySQL® is a registered trademark of MySQL AB in the United States, the European Union and other countries.

Node.js® is an official trademark of Joyent. Red Hat is not formally related to or endorsed by the official Joyent Node.js open source or commercial project.

The OpenStack® Word Mark and OpenStack logo are either registered trademarks/service marks or trademarks/service marks of the OpenStack Foundation, in the United States and other countries and are used with the OpenStack Foundation's permission. We are not affiliated with, endorsed or sponsored by the OpenStack Foundation, or the OpenStack community.

All other trademarks are the property of their respective owners.

配置 GitHub 操作

了解如何为安全 CI/CD 工作流配置 GitHub 操作。

前言
复制链接

第 1 章在 GitHub Actions 中添加用于与外部工具集成的 secret 和变量
复制链接

1.1. 选项 1：使用 UI 将 secret 和变量添加到 GitHub Actions
复制链接

1.2. 选项 2：使用 CLI 将 secret 和变量添加到 GitHub Actions
复制链接

法律通告
复制链接

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

配置 GitHub 操作

了解如何为安全 CI/CD 工作流配置 GitHub 操作。

前言复制链接链接已复制到粘贴板!

第 1 章 在 GitHub Actions 中添加用于与外部工具集成的 secret 和变量复制链接链接已复制到粘贴板!

1.1. 选项 1：使用 UI 将 secret 和变量添加到 GitHub Actions复制链接链接已复制到粘贴板!

1.2. 选项 2：使用 CLI 将 secret 和变量添加到 GitHub Actions复制链接链接已复制到粘贴板!

法律通告复制链接链接已复制到粘贴板!

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

前言
复制链接

第 1 章在 GitHub Actions 中添加用于与外部工具集成的 secret 和变量
复制链接

1.1. 选项 1：使用 UI 将 secret 和变量添加到 GitHub Actions
复制链接

1.2. 选项 2：使用 CLI 将 secret 和变量添加到 GitHub Actions
复制链接

法律通告
复制链接