DevSecOps with Shipwright and Tekton
summary
A Go hello‑world is built locally and in CI using Shipwright and Tekton: ko assembles two images (artifact plus SBOMs), Shipwright buildruns push to an internal registry and later to GitHub Packages, Pipelines as Code triggers on PRs, Tekton Chains records provenance and cosign signs artifacts. All builds and PR validations complete successfully, though custom tasks and some integrations are still alpha/experimental and may change.
AI-written summary · about
chapters (4)
related talks
33mProject Shipwright: Build Container Images on k8s
41mDogfooding Tekton project with Tekton
34mFrom Code to Deployment: A Deep Dive into Pipelines as Code
33mFrom Pipelines To Provenance: Reproducible Builds With Tekton
29mContinuous Integration and Continuous Delivery Pipelines: Just the Basics
16mOperating Tekton with Secure Defaults
38mRobocat Meets Octopus and Octocat: Interoperability in CI/CD
26mSecure and Reliable Container Image Creation with Shipwright in the Supply Chain