sign Docker image on release #5

.github/workflows/release-build.yml

@@ -38,6 +38,14 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
 
+      - name: Install Cosign
+        uses: sigstore/[email protected]
+        with:
+          cosign-release: 'v1.9.0'
+
+      - name: Setup Docker Buildx
+        uses: docker/[email protected]
+
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v2
         with:
@@ -52,9 +60,18 @@ jobs:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
       - name: Build + Push Docker image
+        id: build-and-push
         uses: docker/build-push-action@v3
         with:
           context: .
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
+
+      # Sign the Docker image digest
+      # Uses the identity token to provision an ephemeral certificate against the community Fulcio instance
+      # https://github.com/sigstore/cosign
+      - name: Sign the Docker image
+        env:
+          COSIGN_EXPERIMENTAL: "true"
+        run: cosign sign ${{ steps.meta.outputs.tags }}@${{ steps.build-and-push.outputs.digest }}