diff --git a/README.md b/README.md index da06cf9..a8654c5 100644 --- a/README.md +++ b/README.md @@ -71,3 +71,5 @@ jobs: cert-identity: https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main oidc-issuer: https://token.actions.githubusercontent.com ``` + +While not recommended, you may also opt to fail verification silently without disrupting your workflow by setting `fail-silently: 'true'`. diff --git a/verify/action.yml b/verify/action.yml index db34e6d..e20a7ed 100644 --- a/verify/action.yml +++ b/verify/action.yml @@ -8,6 +8,10 @@ inputs: containers: description: 'Names of the target containers to verify' required: true + fail-silently: + description: 'Fail without exiting.' + default: 'false' + required: false pubkey: description: 'Public key used by target container' default: 'https://raw.githubusercontent.com/ublue-os/main/main/cosign.pub' @@ -34,14 +38,18 @@ runs: for CONTAINER in $(echo "${CONTAINERS}" | tr "," "\n"); do if ! cosign verify $REGISTRY/${CONTAINER} --certificate-identity=${{ inputs.cert-identity }} --certificate-oidc-issuer=${{ inputs.oidc-issuer }} | jq; then echo "NOTICE: Verification failed. Please ensure your public key is correct." - exit 1 + if [[ "${{ matrix.fail-silently }}" != 'true' ]]; then + exit 1 + fi fi done elif [[ -n "${{ inputs.pubkey }}" ]]; then for CONTAINER in $(echo "${CONTAINERS}" | tr "," "\n"); do if ! cosign verify --key ${{ inputs.pubkey }} $REGISTRY/${CONTAINER} | jq; then echo "NOTICE: Verification failed. Please ensure your public key is correct." - exit 1 + if [[ "${{ matrix.fail-silently }}" != 'true' ]]; then + exit 1 + fi fi done else