|
|
@@ -78,18 +78,3 @@ jobs:
|
|
|
push: ${{ github.event_name != 'pull_request' }}
|
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
|
-
|
|
|
- # Sign the resulting Docker image digest except on PRs.
|
|
|
- # This will only write to the public Rekor transparency log when the Docker
|
|
|
- # repository is public to avoid leaking data. If you would like to publish
|
|
|
- # transparency data even for private images, pass --force to cosign below.
|
|
|
- # https://github.com/sigstore/cosign
|
|
|
- - name: Sign the published Docker image
|
|
|
- if: ${{ github.event_name != 'pull_request' }}
|
|
|
- env:
|
|
|
- # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
|
|
|
- TAGS: ${{ steps.meta.outputs.tags }}
|
|
|
- DIGEST: ${{ steps.build-and-push.outputs.digest }}
|
|
|
- # This step uses the identity token to provision an ephemeral certificate
|
|
|
- # against the sigstore community Fulcio instance.
|
|
|
- run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
|
dzp