This commit is contained in:
gunnar
2026-06-06 11:13:49 +02:00
parent 303792dde2
commit 0859168fc9
+4 -1
View File
@@ -110,7 +110,10 @@ jobs:
- name: Sign container image - name: Sign container image
if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false' if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
run: | run: |
DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' humocs-man.duckdns.org/humocs-man/fluffy-pancake:stable) # 1. Wir lösen das Tag in der Registry zu einem Digest auf (kein Docker-Daemon nötig)
DIGEST=$(cosign resolve humocs-man.duckdns.org/humocs-man/fluffy-pancake:stable)
# 2. Wir signieren EXAKT diesen Digest (als OCI-Referenz, nicht als Tag-Signature)
cosign sign -y \ cosign sign -y \
--key env://COSIGN_PRIVATE_KEY \ --key env://COSIGN_PRIVATE_KEY \
"$DIGEST" "$DIGEST"