Merge pull request #1123 from ko-build/dependabot/github_actions/acti… #362

	name: image

	on:
	push:
	branches: ['main']
	workflow_dispatch:

	permissions:
	contents: read
	packages: write
	id-token: write

	jobs:
	image:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
	- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
	with:
	go-version: '1.20'
	check-latest: true
	- uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 # v3.1.1

	# Build ko from HEAD, build and push an image tagged with the commit SHA,
	# then keylessly sign it with cosign.
	- name: Publish and sign image
	env:
	KO_DOCKER_REPO: ghcr.io/${{ github.repository }}
	COSIGN_EXPERIMENTAL: 'true'
	run: \|
	go build ./
	echo "${{ github.token }}" \| ./ko login ghcr.io --username "${{ github.actor }}" --password-stdin
	img=$(./ko build --bare --platform=all -t latest -t ${{ github.sha }} ./)
	echo "built ${img}"
	cosign sign ${img} --yes \
	-a sha=${{ github.sha }} \
	-a run_id=${{ github.run_id }} \
	-a run_attempt=${{ github.run_attempt }}

Provide feedback