diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 716b99d..caa5455 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -4,13 +4,13 @@ on: pull_request: branches: - main - schedule: - - cron: '05 10 * * *' # 10:05am UTC everyday - push: - branches: - - main - paths-ignore: - - '**/README.md' + # schedule: + # - cron: '05 10 * * *' # 10:05am UTC everyday + # push: + # branches: + # - main + # paths-ignore: + # - '**/README.md' workflow_dispatch: env: @@ -178,21 +178,21 @@ jobs: # OPTIONAL: Image Signing with Cosign # Signing is disabled by default. To enable, see README.md "Optional: Enable Image Signing" section. - # - name: Install Cosign - # uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0 - # if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) - # - # - name: Sign container image - # if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) - # run: | - # IMAGE_FULL="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}" - # for tag in ${{ steps.metadata.outputs.tags }}; do - # cosign sign -y --key env://COSIGN_PRIVATE_KEY $IMAGE_FULL:$tag - # done - # env: - # TAGS: ${{ steps.push.outputs.digest }} - # COSIGN_EXPERIMENTAL: false - # COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} + - name: Install Cosign + uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0 + if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) + + - name: Sign container image + if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) + run: | + IMAGE_FULL="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}" + for tag in ${{ steps.metadata.outputs.tags }}; do + cosign sign -y --key env://COSIGN_PRIVATE_KEY $IMAGE_FULL:$tag + done + env: + TAGS: ${{ steps.push.outputs.digest }} + COSIGN_EXPERIMENTAL: false + COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} # OPTIONAL: SBOM Attestation # Attaches SBOM (Software Bill of Materials) to your signed image for supply chain security.