plexer-cli 0.1.19__tar.gz → 0.1.21__tar.gz

{plexer_cli-0.1.19 → plexer_cli-0.1.21}/.github/workflows/release.yml

@@ -110,6 +110,9 @@ jobs:
           ref: ${{ github.event.inputs.tag }}
           fetch-depth: 0
 
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2
+
       - name: Log in to Docker Hub
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
         with:
@@ -130,6 +133,7 @@ jobs:
           images: |
             magneticstain/plexer
             ghcr.io/${{ github.repository }}
+          tags: type=sha,format=long
 
       # required for multi-platform builds (e.g. arm64)
       - name: Set up QEMU
@@ -165,10 +169,34 @@ jobs:
           provenance: mode=max
           sbom: true
 
-      - name: Generate artifact attestation for GHCR container image
+      - name: Sign and verify images
+        env:
+          DIGEST: ${{ steps.push.outputs.digest }}
+          TAGS: ${{ steps.meta.outputs.tags }}
+        run: |
+          IMAGES=""
+          for tag in ${TAGS}; do
+            IMAGES+="${tag}@${DIGEST} "
+          done
+
+          cosign sign --yes ${IMAGES}
+
+          cosign verify ${IMAGES} \
+            --certificate-identity=https://github.com/magneticstain/${{ github.repository }}/.github/workflows/release.yml@refs/heads/${{ github.ref_name }} \
+            --certificate-oidc-issuer=https://token.actions.githubusercontent.com
+
+      - name: Generate artifact attestation for container images
         uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6  # v4.2.2
         with:
-          subject-name: ghcr.io/${{ github.repository }}
+          subject-name: |
+            docker.io/magneticstain/plexer
+            ghcr.io/${{ github.repository }}
           subject-digest: ${{ steps.push.outputs.digest }}
-          sbom-path: "sbom.spdx.json"  # REF: https://docs.docker.com/build/metadata/attestations/sbom/#verify-sbom-attestations
           push-to-registry: true
+
+      - name: Verify container attestation
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # verify image attestation
+          gh attestation verify oci://ghcr.io/${{ github.repository }}:${{ github.ref_name }} -R ${{ github.repository }}

{plexer_cli-0.1.19 → plexer_cli-0.1.21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: plexer_cli
-Version: 0.1.19
+Version: 0.1.21
 Summary: Normalize media files and directories for use with Plex Media Server
 Project-URL: Repository, https://github.com/magneticstain/plexer
 Project-URL: Documentation, https://github.com/magneticstain/plexer-cli/wiki

{plexer_cli-0.1.19 → plexer_cli-0.1.21}/src/plexer_cli/main.py

@@ -6,7 +6,7 @@ Main App Entrypoint
 """
 
 __author__ = "magneticstain"
-__version__ = "0.1.19"
+__version__ = "0.1.21"
 __license__ = "MIT"
 
 import argparse