.gitea/workflows/build.yml aktualisiert

.gitea/workflows/build.yml

@@ -113,6 +113,21 @@ jobs:
             BUILDKIT_OCI_MEDIATYPE=true
 
           outputs: ${{ github.event_name != 'pull_request' && format('type=registry,push=true,oci-mediatypes=true,compression=zstd,compression-args=binary-path=/usr/bin/go-zstd-chunked') || '' }}
+      - name: Inspect pushed image
+        if: github.event_name != 'pull_request' && github.ref_name == 'main'
+        run: |
+          set -euo pipefail
+
+          IMAGE="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}"
+          DIGEST="${{ steps.build_image.outputs.digest }}"
+
+          echo "Buildx digest:"
+          echo "${DIGEST}"
+
+          echo
+          echo "Registry digest:"
+          docker buildx imagetools inspect \
+          "${IMAGE}:${DEFAULT_TAG}"
 
       - name: Install gettext dependencies
         if: github.event_name != 'pull_request' && github.ref_name == 'main'
@@ -150,7 +165,7 @@ jobs:
             --registry-referrers-mode=legacy \
             "${IMAGE}@${DIGEST}"
 
-      - name: Verify container image
+      - name: Debug container signature
         if: github.event_name != 'pull_request' && github.ref_name == 'main'
         run: |
           set -euo pipefail
@@ -158,13 +173,24 @@ jobs:
           IMAGE="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}"
           DIGEST="${{ steps.build_image.outputs.digest }}"
 
-          test -f configs/cosign.pub
+          echo "Image: ${IMAGE}"
+          echo "Digest: ${DIGEST}"
 
-          cosign verify \
-            --key configs/cosign.pub \
-            --new-bundle-format=false \
-            --registry-referres-mode=legacy \
-            "${IMAGE}@${DIGEST}"
+          echo
+          echo "=== Cosign version ==="
+          cosign version
+
+          echo
+          echo "=== Cosign tree ==="
+          cosign tree \
+          --registry-referrers-mode=legacy \
+          "${IMAGE}@${DIGEST}"
+
+          echo
+          echo "=== Cosign download signature ==="
+          cosign download signature \
+      -   -registry-referrers-mode=legacy \
+           "${IMAGE}@${DIGEST}"
 
       - name: Post-Build Cleanup
         if: always()