chore: research changes in cosign (#6)

.github/workflows/build-push.yml

@@ -2,7 +2,7 @@ name: Docker Builds
 
 on:
   push:
-    tags: [ 'v*' ]
+    tags: ["v*"]
   workflow_dispatch:
 
 env:
@@ -13,7 +13,6 @@ concurrency:
   group: ${{ github.workflow }}-$${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
-
 jobs:
   build-push:
     runs-on: ubuntu-latest
@@ -54,5 +53,11 @@ jobs:
       - name: Sign the published Docker image
         if: github.event_name == 'push'
         env:
-          COSIGN_EXPERIMENTAL: "true"
-        run: cosign sign ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }}
+          DIGEST: ${{ steps.build-and-push.outputs.digest }}
+          TAGS: ${{ steps.docker_meta.outputs.tags }}
+        run: |
+          images=""
+          for tag in ${TAGS}; do
+            images+="${tag}@${DIGEST} "
+          done
+          cosign sign --yes ${images}