GitHub Actions Integration

GitHub Actions Integration with TigerTrust

TigerTrust provides official GitHub Actions for seamless certificate lifecycle management in your GitHub workflows. Leverage enterprise code signing, certificate provisioning, and compliance validation directly in your CI/CD pipelines.

OIDC Authentication

Use GitHub's OIDC provider for secure, secret-less authentication:

yaml
1name: Deploy with TLS
2on:
3  push:
4    branches: [main]
5
6permissions:
7  id-token: write
8  contents: read
9
10jobs:
11  deploy:
12    runs-on: ubuntu-latest
13    steps:
14      - uses: actions/checkout@v4
15
16      - name: Authenticate with TigerTrust
17        uses: tigertrust/auth-action@v1
18        with:
19          audience: 'https://api.tigertrust.io'
20          org-id: ${{ vars.TIGERTRUST_ORG_ID }}

Code Signing Action

Sign build artifacts with enterprise code signing certificates:

yaml
1name: Build and Sign
2on:
3  release:
4    types: [created]
5
6jobs:
7  build-and-sign:
8    runs-on: ubuntu-latest
9    steps:
10      - uses: actions/checkout@v4
11
12      - name: Build application
13        run: |
14          npm ci
15          npm run build
16
17      - name: Sign artifacts
18        uses: tigertrust/sign-action@v1
19        with:
20          certificate-name: 'release-signing-cert'
21          artifacts: |
22            dist/*.js
23            dist/*.mjs
24          timestamp-server: 'https://timestamp.digicert.com'
25
26      - name: Upload signed artifacts
27        uses: actions/upload-artifact@v4
28        with:
29          name: signed-release
30          path: dist/

Certificate Provisioning

Provision certificates for deployment:

yaml
1name: Provision and Deploy
2on:
3  workflow_dispatch:
4
5jobs:
6  provision-certificate:
7    runs-on: ubuntu-latest
8    outputs:
9      cert-id: ${{ steps.provision.outputs.certificate-id }}
10    steps:
11      - name: Provision certificate
12        id: provision
13        uses: tigertrust/provision-action@v1
14        with:
15          common-name: 'app.example.com'
16          san-names: |
17            app.example.com
18            www.example.com
19          issuer: 'letsencrypt-prod'
20          validity-days: 90
21
22  deploy:
23    needs: provision-certificate
24    runs-on: ubuntu-latest
25    steps:
26      - name: Download certificate
27        uses: tigertrust/download-action@v1
28        with:
29          certificate-id: ${{ needs.provision-certificate.outputs.cert-id }}
30          output-path: ./certs
31
32      - name: Deploy to Kubernetes
33        run: |
34          kubectl create secret tls app-tls \
35            --cert=./certs/cert.pem \
36            --key=./certs/key.pem

Compliance Validation

Validate certificates in pull requests:

yaml
1name: Certificate Compliance
2on:
3  pull_request:
4    paths:
5      - 'certs/**'
6      - 'kubernetes/**/*.yaml'
7
8jobs:
9  validate:
10    runs-on: ubuntu-latest
11    steps:
12      - uses: actions/checkout@v4
13
14      - name: Validate certificates
15        uses: tigertrust/validate-action@v1
16        with:
17          certificate-paths: |
18            certs/*.pem
19            kubernetes/**/tls.yaml
20          policy: 'production-policy'
21          fail-on-violation: true
22
23      - name: Post validation results
24        if: always()
25        uses: tigertrust/report-action@v1
26        with:
27          report-type: 'pr-comment'

Reusable Workflows

Create organization-wide certificate workflows:

yaml
1# .github/workflows/sign-release.yml
2name: Sign Release
3on:
4  workflow_call:
5    inputs:
6      artifact-name:
7        required: true
8        type: string
9    secrets:
10      TIGERTRUST_API_KEY:
11        required: true
12
13jobs:
14  sign:
15    runs-on: ubuntu-latest
16    steps:
17      - uses: tigertrust/sign-action@v1
18        with:
19          api-key: ${{ secrets.TIGERTRUST_API_KEY }}
20          certificate-name: 'org-signing-cert'
21          artifacts: ${{ inputs.artifact-name }}

Container Image Signing

Sign container images with Sigstore/Cosign:

yaml
1name: Build and Sign Container
2on:
3  push:
4    tags: ['v*']
5
6jobs:
7  build:
8    runs-on: ubuntu-latest
9    steps:
10      - uses: actions/checkout@v4
11
12      - name: Build container
13        run: docker build -t myapp:${{ github.ref_name }} .
14
15      - name: Sign container image
16        uses: tigertrust/cosign-action@v1
17        with:
18          certificate-name: 'container-signing-cert'
19          image: 'ghcr.io/${{ github.repository }}:${{ github.ref_name }}'
20          registry: 'ghcr.io'

Matrix Builds

Sign artifacts across multiple platforms:

yaml
1jobs:
2  build:
3    strategy:
4      matrix:
5        os: [ubuntu-latest, windows-latest, macos-latest]
6    runs-on: ${{ matrix.os }}
7    steps:
8      - uses: tigertrust/sign-action@v1
9        with:
10          certificate-name: '${{ matrix.os }}-signing-cert'
11          artifacts: 'build/*'

Automate enterprise code signing and certificate management in your GitHub workflows with TigerTrust.