Merge pull request #29 from shyim/setup-cosign

ci: setup cosign
shyim · Apr 6, 2024 · f0e6b5e · f0e6b5e
2 parents d4c2c64 + 314b999
commit f0e6b5e
Showing 1 changed file with 16 additions and 0 deletions.
diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
@@ -11,15 +11,22 @@ on:
 
 permissions:
     contents: read
+    id-token: write
     packages: write
 
+env:
+  COSIGN_EXPERIMENTAL: 1
+
 jobs:
     base:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout
               uses: actions/checkout@v4
 
+            - name: Install Cosign
+              uses: sigstore/cosign-installer@v3
+
             - name: Set up QEMU
               uses: docker/setup-qemu-action@v3
 
@@ -37,6 +44,9 @@ jobs:
                 push: true
                 provenance: false
 
+            - name: Sign image
+              run: cosign sign --yes ghcr.io/shyim/wolfi-php/base:latest
+
     frankenphp:
       runs-on: ubuntu-latest
       strategy:
@@ -48,6 +58,9 @@ jobs:
           - name: Checkout
             uses: actions/checkout@v4
 
+          - name: Install Cosign
+            uses: sigstore/cosign-installer@v3
+
           - name: Set up QEMU
             uses: docker/setup-qemu-action@v3
 
@@ -65,3 +78,6 @@ jobs:
               build-args: PHP_VERSION=${{ matrix.php }}
               push: true
               provenance: false
+
+          - name: Sign image
+            run: cosign sign --yes ghcr.io/shyim/wolfi-php/frankenphp:${{ matrix.php }}