Feat: Implementing Sigstore-A2A verification for A2A Agent Cards #5
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Sign A2A agent card with sigstore-a2a using the official pattern from sigstore-a2a repo | |
| # Based on: https://github.com/sigstore/sigstore-a2a/blob/main/.github/workflows/ci.yml | |
| name: Sign and verify agent card (sigstore-a2a) | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| id-token: write | |
| contents: read | |
| jobs: | |
| sign-agent-card: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.13" | |
| - name: Install UV | |
| uses: astral-sh/setup-uv@v7 | |
| with: | |
| version: "latest" | |
| - name: Cache UV dependencies | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.cache/uv | |
| key: ${{ runner.os }}-uv-sigstore-a2a | |
| - name: Install sigstore-a2a with pinned dependencies | |
| run: | | |
| # Pin a2a-sdk to specific version | |
| uv pip install --system --prerelease=allow "a2a-sdk==0.2.16" | |
| # Pin sigstore-a2a to specific commit SHA for reproducibility and security | |
| # Commit 293f9bd from 2026-03-30: "ci(deps): Bump actions/deploy-pages from 4 to 5" | |
| # Update periodically by checking: https://github.com/sigstore/sigstore-a2a/commits/main | |
| uv pip install --system --prerelease=allow "git+https://github.com/sigstore/sigstore-a2a.git@293f9bd" | |
| - name: Get GitHub OIDC token | |
| run: | | |
| # Fetch OIDC token directly from GitHub Actions | |
| OIDC_TOKEN=$(curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \ | |
| "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=sigstore" | jq -r '.value') | |
| echo "$OIDC_TOKEN" > oidc-token.txt | |
| - name: Sign agent card | |
| run: | | |
| sigstore-a2a sign \ | |
| --output signed-agent-card.json \ | |
| --repository "${{ github.repository }}" \ | |
| --provenance \ | |
| --identity_token "$(cat oidc-token.txt)" \ | |
| kagenti-operator/examples/ci-agent-card.json | |
| - name: Verify signature | |
| run: | | |
| sigstore-a2a verify \ | |
| --identity_provider "https://token.actions.githubusercontent.com" \ | |
| --repository "${{ github.repository }}" \ | |
| --workflow "${{ github.workflow }}" \ | |
| signed-agent-card.json | |
| - name: Upload signed agent card | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: signed-agent-card | |
| path: signed-agent-card.json | |
| retention-days: 14 |