next try cosign

.gitea/workflows/build.yml

@@ -140,18 +140,18 @@ jobs:
 
       - name: Sign container image
         if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
+        env:
+          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
+          COSIGN_PASSWORD: ""
         run: |
           IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}"
 
           echo "Fetching digest for $IMAGE_REF..."
           DIGEST=$(skopeo inspect --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" docker://$IMAGE_REF --format '{{.Digest}}')
 
-              echo "Signing OCI reference with Legacy settings..."
+          echo "Signing with legacy settings..."
           cosign sign -y \
             --key env://COSIGN_PRIVATE_KEY \
             --registry-referrers-mode=legacy \
             --new-bundle-format=false \
             "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}"
-            env:
-              COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
-              COSIGN_PASSWORD: ""