Sign with cosign

jessedearing · Sep 5, 2024 · 43297e9 · 43297e9
1 parent 75ca9a5
commit 43297e9
Showing 1 changed file with 7 additions and 6 deletions.
diff --git a/.github/workflows/dockerimage.yml b/.github/workflows/dockerimage.yml
@@ -36,9 +36,10 @@ jobs:
         push: true
         tags: |
           ghcr.io/jessedearing/debug:latest
-    - name: Generate artifact attestation
-      uses: actions/attest-build-provenance@v1
-      with:
-        subject-name: ghcr.io/jessedearing/debug
-        subject-digest: ${{ steps.push.outputs.digest }}
-        push-to-registry: true
+    - name: Install cosign
+      uses: sigstore/cosign-installer@v3.6.0
+    - name: Sign images with GitHub OIDC
+      env:
+        DIGEST: ${{ steps.push.outputs.digest }}
+      run: |
+        cosign sign --yes ghcr.io/jessedearing/debug:latest