From 73fa206f610333e8d3a47e0671db5862a3ba96e8 Mon Sep 17 00:00:00 2001
From: gunnar <gunnar@users.noreply.github.com>
Date: Fri, 12 Jun 2026 16:28:34 +0200
Subject: [PATCH] cosign action

---
 .gitea/workflows/build.yml | 41 +++++++++++++++-----------------------
 1 file changed, 16 insertions(+), 25 deletions(-)

diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index a97ba61..5b353ce 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -97,32 +97,23 @@ jobs:
           tags: ${{ steps.metadata.outputs.tags }}
           labels: ${{ steps.metadata.outputs.labels }}
 
-      - name: Install Skopeo (Required for Cosign Inspect)
-        if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y skopeo gettext
-
-      - name: Install Cosign
-        if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
-        uses: sigstore/cosign-installer@v4
-
       - name: Sign container image
         if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
-        env:
-          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
-          COSIGN_PASSWORD: ""
-        run: |
-          IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}"
+        uses: sigstore/cosign-sign-action@v3
+        with:
+          # Bild-Referenz ohne Tag, da die Action den Digest oder Tag separat trennt
+          image-repository: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
+          image-tag: ${{ env.IMAGE_TAG }}
 
-          echo "Fetching digest for $IMAGE_REF..."
-          DIGEST=$(skopeo inspect --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" docker://$IMAGE_REF --format '{{.Digest}}')
+          # Authentifizierung für deine Gitea-Registry (wichtig, damit die Action das Image pushen darf)
+          registry-username: ${{ github.repository_owner }}
+          registry-password: ${{ secrets.REGISTRY }}
 
-          echo "Signing image with explicit Cosign v3 legacy bypass..."
-          cosign sign -y \
-            --key env://COSIGN_PRIVATE_KEY \
-            --use-signing-config=false \
-            --new-bundle-format=false \
-            --tlog-upload=false \
-            --registry-referrers-mode=legacy \
-            "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}"
+          # Deine Keys aus den Secrets geladen
+          cosign-private-key: ${{ secrets.SIGNING_SECRET }}
+          cosign-password: ""
+
+          # Deine spezifischen Flags für den Gitea/bootc Legacy-Bypass:
+          registry-referrers-api: 'legacy'
+          cosign-tlog-upload: 'false'
+          use-signing-config: 'false'