chore(ci): cosign signing for legacy hwe support (ublue-os#1893)

bobslept · Nov 6, 2024 · 4fb5f25 · 4fb5f25
1 parent dcb1ffb
commit 4fb5f25
Showing 1 changed file with 14 additions and 0 deletions.
diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml
@@ -407,6 +407,20 @@ jobs:
           COSIGN_EXPERIMENTAL: false
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
 
+      - name: Sign container image
+        if: github.event_name != 'pull_request' && contains(inputs.image_flavors, 'hwe')
+        shell: bash
+        run: |
+          image_name="${{ env.IMAGE_NAME }}"
+          asus_name="${image_name/hwe/asus}"
+          surface_name="${image_name/hwe/surface}"
+          cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${asus_name}@${TAGS}
+          cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${surface_name}@${TAGS}
+        env:
+          TAGS: ${{ steps.push.outputs.outputs && fromJSON(steps.push.outputs.outputs).digest }}
+          COSIGN_EXPERIMENTAL: false
+          COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
+
       - name: Generate file containing outputs
         if: github.event_name != 'pull_request'
         env: