diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml index 377c6342c0d..2ae01823a96 100644 --- a/.github/workflows/create-release.yml +++ b/.github/workflows/create-release.yml @@ -44,9 +44,33 @@ jobs: script: | const tag = process.env.TAG; const commitHash = process.env.COMMIT_HASH; + + const cosignSection = [ + `## Verify Docker Image Signature`, + ``, + `All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). To verify the integrity of an image before deploying:`, + ``, + '```bash', + `cosign verify \\`, + ` --key https://raw.githubusercontent.com/BerriAI/litellm/${tag}/cosign.pub \\`, + ` ghcr.io/berriai/litellm:${tag}`, + '```', + ``, + `Expected output:`, + ``, + '```', + `The following checks were performed on each of these signatures:`, + ` - The cosign claims were validated`, + ` - The signatures were verified against the specified public key`, + '```', + ``, + `---`, + ``, + ].join('\n'); + try { - await github.rest.repos.createRelease({ - draft: false, + const response = await github.rest.repos.createRelease({ + draft: true, generate_release_notes: true, target_commitish: commitHash, name: tag, @@ -55,6 +79,15 @@ jobs: repo: context.repo.repo, tag_name: tag, }); + + const updatedBody = cosignSection + (response.data.body ?? ''); + await github.rest.repos.updateRelease({ + owner: context.repo.owner, + repo: context.repo.repo, + release_id: response.data.id, + body: updatedBody, + draft: false, + }); } catch (error) { core.setFailed(error.message); }