diff --git a/.github/workflows/docker-prereleases.yml b/.github/workflows/docker-prereleases.yml index 24e8ea0..e9aa00c 100644 --- a/.github/workflows/docker-prereleases.yml +++ b/.github/workflows/docker-prereleases.yml @@ -38,15 +38,6 @@ jobs: - name: Checkout repository uses: actions/checkout@v3 - # # Install the cosign tool except on PR - # # https://github.com/sigstore/cosign-installer - # - name: Install cosign - # if: github.event_name != 'pull_request' - # uses: sigstore/cosign-installer@f3c664df7af409cb4873aa5068053ba9d61a57b6 #v2.6.0 - # with: - # cosign-release: 'v1.11.0' - - # Workaround: https://github.com/docker/build-push-action/issues/461 - name: Setup Docker buildx uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf @@ -83,16 +74,3 @@ jobs: push: ${{ github.event_name != 'pull_request' }} tags: ghcr.io/${{ github.repository }}:feature-${{ steps.date.outputs.date }} labels: ${{ steps.meta.outputs.labels }} - - # # Sign the resulting Docker image digest except on PRs. - # # This will only write to the public Rekor transparency log when the Docker - # # repository is public to avoid leaking data. If you would like to publish - # # transparency data even for private images, pass --force to cosign below. - # # https://github.com/sigstore/cosign - # - name: Sign the published Docker image - # if: ${{ github.event_name != 'pull_request' }} - # env: - # COSIGN_EXPERIMENTAL: "true" - # # This step uses the identity token to provision an ephemeral certificate - # # against the sigstore community Fulcio instance. - # run: echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign sign {}@${{ steps.build-and-push.outputs.digest }} diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 5d849ce..95400cd 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -38,15 +38,6 @@ jobs: - name: Checkout repository uses: actions/checkout@v3 - # Install the cosign tool except on PR - # https://github.com/sigstore/cosign-installer - - name: Install cosign - if: github.event_name != 'pull_request' - uses: sigstore/cosign-installer@7e0881f8fe90b25e305bbf0309761e9314607e25 - with: - cosign-release: 'v1.9.0' - - # Workaround: https://github.com/docker/build-push-action/issues/461 - name: Setup Docker buildx uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf @@ -79,16 +70,3 @@ jobs: push: ${{ github.event_name != 'pull_request' }} tags: ${{ steps.meta.outputs.tags }},ghcr.io/${{ github.repository }}:latest labels: ${{ steps.meta.outputs.labels }} - - # Sign the resulting Docker image digest except on PRs. - # This will only write to the public Rekor transparency log when the Docker - # repository is public to avoid leaking data. If you would like to publish - # transparency data even for private images, pass --force to cosign below. - # https://github.com/sigstore/cosign - - name: Sign the published Docker image - if: ${{ github.event_name != 'pull_request' }} - env: - COSIGN_EXPERIMENTAL: "true" - # This step uses the identity token to provision an ephemeral certificate - # against the sigstore community Fulcio instance. - run: cosign sign ${{ steps.meta.outputs.tags }}@${{ steps.build-and-push.outputs.digest }}