sign artifacts (#314)

.github/CODEOWNERS

@@ -0,0 +1 @@
+VERSION @hsn723

.github/workflows/main.yml

@@ -80,6 +80,7 @@ jobs:
           fetch-depth: 0
       - uses: docker/setup-qemu-action@v2
       - uses: docker/setup-buildx-action@v2
+      - uses: anchore/sbom-action/[email protected]
       - name: Setup go
         uses: actions/setup-go@v3
         with:
@@ -88,7 +89,7 @@ jobs:
         uses: goreleaser/goreleaser-action@v3
         with:
           version: latest
-          args: --snapshot --skip-publish --rm-dist
+          args: --snapshot --skip-sign --skip-publish --rm-dist
       - name: Test built containers
         run: make container-structure-test
   tag:

.github/workflows/release.yml

@@ -3,6 +3,9 @@ on:
   push:
     tags:
       - 'v*'
+permissions:
+  contents: write
+  id-token: write
 jobs:
   release:
     runs-on: ubuntu-latest
@@ -15,11 +18,8 @@ jobs:
           fetch-depth: 0
       - uses: docker/setup-qemu-action@v2
       - uses: docker/setup-buildx-action@v2
-      - name: Docker Login
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - uses: sigstore/[email protected]
+      - uses: anchore/sbom-action/[email protected]
       - name: GHCR Login
         uses: docker/login-action@v2
         with:

.goreleaser.yml

@@ -69,3 +69,31 @@ snapshot:
   name_template: "{{ .Tag }}-next"
 changelog:
   use: github-native
+source:
+  enabled: true
+sboms:
+  - id: archive
+    artifacts: archive
+  - id: source
+    artifacts: source
+signs:
+  - cmd: cosign
+    env:
+      - COSIGN_EXPERIMENTAL=1
+    certificate: '${artifact}.pem'
+    args:
+      - sign-blob
+      - '--output-certificate=${certificate}'
+      - '--output-signature=${signature}'
+      - '${artifact}'
+    artifacts: checksum
+    output: true
+docker_signs:
+  - cmd: cosign
+    env:
+      - COSIGN_EXPERIMENTAL=1
+    artifacts: images
+    output: true
+    args:
+      - 'sign'
+      - '${artifact}'