signed container v6 (#34)

kuoss · Apr 27, 2024 · d5004cc · d5004cc
1 parent 92227d5
commit d5004cc
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 5 deletions.
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
@@ -57,7 +57,6 @@ jobs:
         tags: |
           type=semver,pattern=v{{version}}
           type=semver,pattern=v{{major}}.{{minor}}
-          type=semver,pattern=v{{major}}
     - uses: docker/login-action@v3
       with:
         registry: ghcr.io
@@ -67,6 +66,19 @@ jobs:
       id: build_and_push
       with:
         context: .
-        push: false
+        push: ${{ github.event_name != 'pull_request' }}
         tags: ${{ steps.docker_metadata.outputs.tags }}
         labels: ${{ steps.docker_metadata.outputs.labels }}
+    - uses: sigstore/cosign-installer@v3
+      if: github.event_name != 'pull_request'
+    - name: Sign the images with GitHub OIDC Token
+      if: github.event_name != 'pull_request'
+      env:
+        DIGEST: ${{ steps.build_and_push.outputs.digest }}
+        TAGS: ${{ steps.docker_metadata.outputs.tags }}
+      run: |
+        images=""
+        for tag in ${TAGS}; do
+          images+="${tag}@${DIGEST} "
+        done
+        cosign sign --yes ${images}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -22,7 +22,6 @@ jobs:
         tags: |
           type=semver,pattern=v{{version}}
           type=semver,pattern=v{{major}}.{{minor}}
-          type=semver,pattern=v{{major}}
     - uses: docker/login-action@v3
       with:
         registry: ghcr.io
@@ -32,12 +31,13 @@ jobs:
       id: build_and_push
       with:
         context: .
-        push: true
+        push: ${{ github.event_name != 'pull_request' }}
         tags: ${{ steps.docker_metadata.outputs.tags }}
         labels: ${{ steps.docker_metadata.outputs.labels }}
-    # sign
     - uses: sigstore/cosign-installer@v3
+      if: github.event_name != 'pull_request'
     - name: Sign the images with GitHub OIDC Token
+      if: github.event_name != 'pull_request'
       env:
         DIGEST: ${{ steps.build_and_push.outputs.digest }}
         TAGS: ${{ steps.docker_metadata.outputs.tags }}