From 4a349216557be40d68c9978a069bd760de5bd36e Mon Sep 17 00:00:00 2001
From: Ivan <ivan@quad4.io>
Date: Wed, 22 Apr 2026 13:33:50 -0500
Subject: [PATCH] feat(ci): add rekor monitoring workflow and setup script for
 rekor-cli installation

---
 .gitea/workflows/rekor-monitor.yml  | 37 ++++++++++++++++++++++++++++
 .github/workflows/rekor-monitor.yml | 24 ++++++++++++++++++
 scripts/ci/setup-rekor-cli.sh       | 38 +++++++++++++++++++++++++++++
 3 files changed, 99 insertions(+)
 create mode 100644 .gitea/workflows/rekor-monitor.yml
 create mode 100644 .github/workflows/rekor-monitor.yml
 create mode 100755 scripts/ci/setup-rekor-cli.sh

diff --git a/.gitea/workflows/rekor-monitor.yml b/.gitea/workflows/rekor-monitor.yml
new file mode 100644
index 0000000..7db80cf
--- /dev/null
+++ b/.gitea/workflows/rekor-monitor.yml
@@ -0,0 +1,37 @@
+name: Rekor tree verification
+
+on:
+    schedule:
+        - cron: "23 11 * * 1"
+    workflow_dispatch:
+
+permissions:
+    contents: read
+
+jobs:
+    rekor-loginfo:
+        runs-on: ubuntu-latest
+        steps:
+            - name: Clone Repo
+              run: |
+                  set -eu
+                  SERVER="${GITEA_SERVER_URL:-${GITHUB_SERVER_URL:-}}"
+                  REPO="${GITEA_REPOSITORY:-${GITHUB_REPOSITORY:-}}"
+                  if [ -z "$SERVER" ] || [ -z "$REPO" ]; then
+                    echo "Checkout: set GITEA_SERVER_URL/GITEA_REPOSITORY or GITHUB_SERVER_URL/GITHUB_REPOSITORY" >&2
+                    exit 1
+                  fi
+                  if [ -n "${GITEA_TOKEN:-}" ] || [ -n "${GITHUB_TOKEN:-}" ]; then
+                    TOKEN="${GITEA_TOKEN:-$GITHUB_TOKEN}"
+                    git config --global credential.helper "!f() { echo username=x-access-token; echo password=${TOKEN}; }; f"
+                  fi
+                  git init -q && git remote add origin "${SERVER}/${REPO}.git"
+                  git fetch -q --depth=1 origin "${GITHUB_SHA}" && git checkout -q FETCH_HEAD
+
+            - name: Install rekor-cli
+              run: sh scripts/ci/setup-rekor-cli.sh
+
+            - name: Verify Rekor signed tree head
+              run: |
+                  set -eu
+                  rekor-cli loginfo --rekor_server "${REKOR_SERVER:-https://rekor.sigstore.dev}" --store_tree_state=false
diff --git a/.github/workflows/rekor-monitor.yml b/.github/workflows/rekor-monitor.yml
new file mode 100644
index 0000000..e9ea8a0
--- /dev/null
+++ b/.github/workflows/rekor-monitor.yml
@@ -0,0 +1,24 @@
+# Cross-run Rekor checkpoint persistence uses Sigstore's reusable workflow (Actions artifact).
+name: Rekor log monitor
+
+on:
+    schedule:
+        - cron: "17 11 * * 1"
+    workflow_dispatch:
+
+concurrency:
+    group: rekor-monitor
+    cancel-in-progress: false
+
+permissions:
+    contents: read
+    id-token: write
+    issues: write
+
+jobs:
+    rekor:
+        uses: sigstore/rekor-monitor/.github/workflows/reusable_monitoring.yml@01680ec70d6bfa0ee4487f9be605c2db13273963
+        secrets: inherit
+        with:
+            file_issue: false
+            artifact_retention_days: 30
diff --git a/scripts/ci/setup-rekor-cli.sh b/scripts/ci/setup-rekor-cli.sh
new file mode 100755
index 0000000..6551eb6
--- /dev/null
+++ b/scripts/ci/setup-rekor-cli.sh
@@ -0,0 +1,38 @@
+#!/bin/sh
+# Install rekor-cli from GitHub releases with SHA256 verification.
+# Usage: setup-rekor-cli.sh [version]
+set -eu
+
+. "$(dirname "$0")/priv.sh"
+
+REKOR_VERSION="${1:-1.5.1}"
+
+ARCH="$(uname -m)"
+case "$ARCH" in
+    x86_64)
+        BINARY="rekor-cli-linux-amd64"
+        EXPECTED_SHA256="0b4964af85477892c37039fb80793b151864970d19838873eaa1a777ca2fb813"
+        ;;
+    aarch64)
+        BINARY="rekor-cli-linux-arm64"
+        EXPECTED_SHA256="6417ea36bea9239125ec21e73c5d9b5e7e837b580cfdfea1e47e04bb02235534"
+        ;;
+    *)
+        echo "Unsupported architecture: $ARCH" >&2
+        exit 1
+        ;;
+esac
+
+BASE_URL="https://github.com/sigstore/rekor/releases/download/v${REKOR_VERSION}"
+curl -fsSL "${BASE_URL}/${BINARY}" -o /tmp/rekor-cli
+
+ACTUAL="$(sha256sum /tmp/rekor-cli | awk '{print $1}')"
+if [ "$EXPECTED_SHA256" != "$ACTUAL" ]; then
+    echo "SHA256 verification failed for ${BINARY}" >&2
+    rm -f /tmp/rekor-cli
+    exit 1
+fi
+
+run_priv install -m 0755 /tmp/rekor-cli /usr/local/bin/rekor-cli
+rm -f /tmp/rekor-cli
+rekor-cli version