feat: cosign verification and signing

.github/workflows/release.yaml

@@ -11,12 +11,29 @@ on:
 jobs:
   docker:
     runs-on: ubuntu-latest
+
+    permissions:
+      actions: none
+      checks: none
+      contents: none
+      deployments: none
+      issues: none
+      packages: write
+      pull-requests: none
+      repository-projects: none
+      security-events: write
+      statuses: none
+      id-token: write # needed for signing the images with GitHub OIDC using cosign
+
     steps:
       - name: Checkout
         uses: actions/checkout@v3
 
+      - name: Install Cosign
+        uses: sigstore/[email protected]
+
       - name: Prepare additional Metadata
-        id: addtional_meta
+        id: additional_meta
         run: |
           echo created=$(date -u +'%Y-%m-%dT%H:%M:%SZ') >> $GITHUB_OUTPUT
 
@@ -41,7 +58,7 @@ jobs:
             vcs-ref=${{ github.sha }}
             revision=${{ github.sha }}
             release=${{ github.sha }}
-            build-date=${{ steps.addtional_meta.outputs.created }}
+            build-date=${{ steps.additional_meta.outputs.created }}
             io.k8s.display-name=RaBe S2I Base Minimal
             io.k8s.description=${{ github.event.repository.description }}
             io.openshift.tags=minimal rhel8 rabe s2i
@@ -53,6 +70,11 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
 
+      - name: Verify signature and annotations on images in Dockerfile using cosign
+        run: cosign dockerfile verify Dockerfile > /dev/null
+        env:
+          COSIGN_EXPERIMENTAL: true
+
       - name: Build Container Image
         id: docker_build
         uses: docker/build-push-action@v3
@@ -103,3 +125,10 @@ jobs:
           labels: |
             ${{ steps.meta.outputs.labels }}
             version=${{ steps.meta.outputs.version }}
+
+      - name: Sign the images with GitHub OIDC Token using cosign
+        run: cosign sign ${TAGS}
+        if: github.event_name != 'pull_request'
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
+          COSIGN_EXPERIMENTAL: true

Dockerfile

@@ -1,4 +1,4 @@
-FROM ghcr.io/radiorabe/s2i-core:2.0.0-alpha.2
+FROM ghcr.io/radiorabe/s2i-core:2.0.0-alpha.3
 
 RUN    microdnf install -y \
          autoconf \