Skip to content

Commit 2a526c8

Browse files
committed
Sign published image manifests with cosign
Add keyless cosign signing for the published multi-arch manifests, including the canonical version tags and latest. The workflow now requests the OIDC token permission needed for GitHub-backed signing and signs the final manifest digests after publication.
1 parent 6f07c01 commit 2a526c8

File tree

1 file changed

+11
-0
lines changed

1 file changed

+11
-0
lines changed

.github/workflows/build.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@ on:
2121
env:
2222
IMAGE_NAME: ${{ inputs.image_name || vars.IMAGE_NAME || 'nikolaik/python-nodejs' }}
2323

24+
permissions:
25+
contents: read
26+
id-token: write
27+
2428
jobs:
2529
generate-matrix:
2630
name: Generate build matrix
@@ -116,6 +120,13 @@ jobs:
116120

117121
- name: Set up Docker Buildx
118122
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
123+
- name: Install Cosign
124+
uses: sigstore/cosign-installer@v4.0.0
125+
126+
- name: Sign multi-arch manifest
127+
run: |
128+
digest="$(docker buildx imagetools inspect "${IMAGE_NAME}:${{ matrix.key }}" | awk '/^Digest:/ {print $2}')"
129+
cosign sign --yes "${IMAGE_NAME}@${digest}"
119130
120131
- name: Add digest to build context
121132
run: |

0 commit comments

Comments
 (0)