cosign action

.gitea/workflows/build.yml

@@ -97,32 +97,23 @@ jobs:
           tags: ${{ steps.metadata.outputs.tags }}
           labels: ${{ steps.metadata.outputs.labels }}
 
-      - name: Install Skopeo (Required for Cosign Inspect)
-        if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y skopeo gettext
-
-      - name: Install Cosign
-        if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
-        uses: sigstore/cosign-installer@v4
-
       - name: Sign container image
         if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
-        env:
-          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
-          COSIGN_PASSWORD: ""
-        run: |
-          IMAGE_REF="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}"
+        uses: sigstore/cosign-sign-action@v3
+        with:
+          # Bild-Referenz ohne Tag, da die Action den Digest oder Tag separat trennt
+          image-repository: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
+          image-tag: ${{ env.IMAGE_TAG }}
 
-          echo "Fetching digest for $IMAGE_REF..."
-          DIGEST=$(skopeo inspect --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" docker://$IMAGE_REF --format '{{.Digest}}')
+          # Authentifizierung für deine Gitea-Registry (wichtig, damit die Action das Image pushen darf)
+          registry-username: ${{ github.repository_owner }}
+          registry-password: ${{ secrets.REGISTRY }}
 
-          echo "Signing image with explicit Cosign v3 legacy bypass..."
-          cosign sign -y \
-            --key env://COSIGN_PRIVATE_KEY \
-            --use-signing-config=false \
-            --new-bundle-format=false \
-            --tlog-upload=false \
-            --registry-referrers-mode=legacy \
-            "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}"
+          # Deine Keys aus den Secrets geladen
+          cosign-private-key: ${{ secrets.SIGNING_SECRET }}
+          cosign-password: ""
+
+          # Deine spezifischen Flags für den Gitea/bootc Legacy-Bypass:
+          registry-referrers-api: 'legacy'
+          cosign-tlog-upload: 'false'
+          use-signing-config: 'false'