From 8f1f6668afb55de26fd0c09c773f5a6cee9b4230 Mon Sep 17 00:00:00 2001 From: James McDuffie Date: Mon, 18 Dec 2023 13:50:39 -0800 Subject: [PATCH] Update cosign step in docker-publish.yml --- .github/workflows/docker-publish.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index e7cfa01..ef83c98 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -4,6 +4,9 @@ name: Docker # They are provided by a third-party and are governed by # separate terms of service, privacy policy, and support # documentation. +# +# Based on: +# https://github.com/actions/starter-workflows/blob/main/ci/docker-publish.yml on: push: @@ -116,10 +119,12 @@ jobs: - name: Sign the published Docker image if: ${{ github.event_name != 'pull_request' }} env: - COSIGN_EXPERIMENTAL: "true" + # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable + TAGS: ${{ steps.meta.outputs.tags }} + DIGEST: ${{ steps.build-and-push.outputs.digest }} # This step uses the identity token to provision an ephemeral certificate # against the sigstore community Fulcio instance. - run: echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign sign {}@${{ steps.build-and-push.outputs.digest }} + run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} - name: Tag as latest uses: Actions-R-Us/actions-tagger@v2