Sign images with cosign on release
To enable artifact attestation, the images are signed with cosign using
the github pipelines oidc token. This makes it easy for artifacts to be
verified by external users and is a standard that kubernetes is centering
on.
@@ -50,6 +50,9 @@ jobs:
publish-images:
runs-on: ubuntu-20.04
needs: [unit-tests]
+ permissions:
+ contents: read
+ id-token: write # needed for signing the images with GitHub OIDC Token
strategy:
fail-fast: true
matrix:
@@ -58,6 +61,11 @@ jobs:
- name: Set up QEMU
uses: docker/setup-qemu-action@v2
+ - name: Install Cosign
+ uses: sigstore/cosign-installer@main
+ with:
+ cosign-release: "v1.9.0"
+
- name: Code checkout
uses: actions/checkout@v3
@@ -87,6 +95,7 @@ jobs:
- name: Build and push ${{ matrix.image }}
uses: docker/build-push-action@v3
+ id: build-and-push
with:
context: .
tags: ${{ steps.meta.outputs.tags }}
@@ -100,6 +109,12 @@ jobs:
GIT_BRANCH: ${{ github.ref_name }}
GIT_COMMIT: ${{ github.sha }}
+ - name: Cosign sign tags
+ run: cosign sign ${TAGS}
+ env:
+ TAGS: ${{ steps.meta.outputs.tags }}@${{ steps.build-and-push.outputs.digest }}
+ COSIGN_EXPERIMENTAL: 1
+
release-charts:
needs: [publish-images]
runs-on: ubuntu-latest
