Manifests signatures with cosign

gimlet-io · Feb 22, 2024 · 4bf7075 · 4bf7075
1 parent eb285dc
commit 4bf7075
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -80,3 +80,10 @@ jobs:
         --source=${{ github.repositoryUrl }} \
         --revision="${{ github.ref_name }}@sha1:${{ github.sha }}" \
         --annotations='org.opencontainers.image.description=Capacitor install manifests for Flux'
+    - name: Sign manifests
+      run: |
+        curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64"
+        sudo mv cosign-linux-amd64 /usr/local/bin/cosign
+        sudo chmod +x /usr/local/bin/cosign
+
+        cosign sign --key=secrets.COSIGNKEY oci://ghcr.io/gimlet-io/capacitor-manifests:${{ steps.version.outputs.version }}