From 7460992941125a2e706480f466d2a7c0f65244a9 Mon Sep 17 00:00:00 2001 From: GamerVII-NET Date: Sat, 25 Oct 2025 08:20:21 +0300 Subject: [PATCH 1/4] =?UTF-8?q?=D0=9E=D0=B1=D0=BD=D0=BE=D0=B2=D0=BB=D0=B5?= =?UTF-8?q?=D0=BD=20workflow=20=D0=BF=D1=83=D0=B1=D0=BB=D0=B8=D0=BA=D0=B0?= =?UTF-8?q?=D1=86=D0=B8=D0=B8=20Docker-=D0=BE=D0=B1=D1=80=D0=B0=D0=B7?= =?UTF-8?q?=D0=BE=D0=B2:=20=D0=BF=D0=B5=D1=80=D0=B5=D1=85=D0=BE=D0=B4=20?= =?UTF-8?q?=D0=BD=D0=B0=20actions/checkout@v4=20=D0=B8=20=D0=B4=D0=BE?= =?UTF-8?q?=D0=B1=D0=B0=D0=B2=D0=BB=D0=B5=D0=BD=D0=B0=20=D0=BF=D0=BE=D0=B4?= =?UTF-8?q?=D0=BF=D0=B8=D1=81=D1=8C=20=D0=BE=D0=BF=D1=83=D0=B1=D0=BB=D0=B8?= =?UTF-8?q?=D0=BA=D0=BE=D0=B2=D0=B0=D0=BD=D0=BD=D1=8B=D1=85=20=D0=BE=D0=B1?= =?UTF-8?q?=D1=80=D0=B0=D0=B7=D0=BE=D0=B2.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/docker-package-publish.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docker-package-publish.yml b/.github/workflows/docker-package-publish.yml index 93409e4..b79ac6e 100644 --- a/.github/workflows/docker-package-publish.yml +++ b/.github/workflows/docker-package-publish.yml @@ -41,7 +41,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v4 # Ensure repository/image name is lowercase for Docker registry - name: Set lowercase image name @@ -181,3 +181,10 @@ jobs: - name: Inspect image run: | docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ steps.image.outputs.lower }}:${{ steps.meta.outputs.version }} + + - name: Sign the published Docker image + if: ${{ github.event_name != 'pull_request' }} + env: + TAGS: ${{ steps.meta.outputs.tags }} + DIGEST: ${{ steps.build-and-push.outputs.digest }} + run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} From b4c45b7cfc72a4ea338b2a8bcfe18f177ba7ec15 Mon Sep 17 00:00:00 2001 From: GamerVII-NET Date: Sat, 25 Oct 2025 08:28:11 +0300 Subject: [PATCH 2/4] =?UTF-8?q?=D0=94=D0=BE=D0=B1=D0=B0=D0=B2=D0=BB=D0=B5?= =?UTF-8?q?=D0=BD=D0=B0=20=D1=83=D1=81=D1=82=D0=B0=D0=BD=D0=BE=D0=B2=D0=BA?= =?UTF-8?q?=D0=B0=20cosign=20=D0=B2=20workflow=20=D0=BF=D1=83=D0=B1=D0=BB?= =?UTF-8?q?=D0=B8=D0=BA=D0=B0=D1=86=D0=B8=D0=B8=20Docker-=D0=BE=D0=B1?= =?UTF-8?q?=D1=80=D0=B0=D0=B7=D0=BE=D0=B2=20=D0=B8=20=D0=BE=D0=B1=D0=BD?= =?UTF-8?q?=D0=BE=D0=B2=D0=BB=D0=B5=D0=BD=20=D0=BF=D1=80=D0=BE=D1=86=D0=B5?= =?UTF-8?q?=D1=81=D1=81=20=D0=BF=D0=BE=D0=B4=D0=BF=D0=B8=D1=81=D0=B8=20?= =?UTF-8?q?=D0=BE=D0=B1=D1=80=D0=B0=D0=B7=D0=BE=D0=B2.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/docker-package-publish.yml | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docker-package-publish.yml b/.github/workflows/docker-package-publish.yml index b79ac6e..b1c91f0 100644 --- a/.github/workflows/docker-package-publish.yml +++ b/.github/workflows/docker-package-publish.yml @@ -182,9 +182,24 @@ jobs: run: | docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ steps.image.outputs.lower }}:${{ steps.meta.outputs.version }} + # Install cosign (before using it) + - name: Install cosign + uses: sigstore/cosign-installer@v3.7.0 + with: + cosign-release: 'v2.2.4' + + # Sign the pushed image by digest (skip on PRs) + - name: Sign image with cosign + if: github.event_name != 'pull_request' + env: + DIGEST: ${{ steps.build.outputs.digest }} + TAGS: ${{ steps.meta.outputs.tags }} + run: | + echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} + - name: Sign the published Docker image if: ${{ github.event_name != 'pull_request' }} env: TAGS: ${{ steps.meta.outputs.tags }} DIGEST: ${{ steps.build-and-push.outputs.digest }} - run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} + run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} \ No newline at end of file From 183b811916b6bc1f3ce892cd008eb8e4204254dc Mon Sep 17 00:00:00 2001 From: GamerVII-NET Date: Sat, 25 Oct 2025 08:28:36 +0300 Subject: [PATCH 3/4] =?UTF-8?q?=D0=A3=D0=B4=D0=B0=D0=BB=D0=B5=D0=BD=20?= =?UTF-8?q?=D0=B4=D1=83=D0=B1=D0=BB=D0=B8=D1=80=D1=83=D1=8E=D1=89=D0=B8?= =?UTF-8?q?=D0=B9=20=D1=88=D0=B0=D0=B3=20=D0=BF=D0=BE=D0=B4=D0=BF=D0=B8?= =?UTF-8?q?=D1=81=D0=B8=20Docker-=D0=BE=D0=B1=D1=80=D0=B0=D0=B7=D0=BE?= =?UTF-8?q?=D0=B2=20=D0=B2=20workflow.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/docker-package-publish.yml | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/.github/workflows/docker-package-publish.yml b/.github/workflows/docker-package-publish.yml index b1c91f0..2678341 100644 --- a/.github/workflows/docker-package-publish.yml +++ b/.github/workflows/docker-package-publish.yml @@ -195,11 +195,4 @@ jobs: DIGEST: ${{ steps.build.outputs.digest }} TAGS: ${{ steps.meta.outputs.tags }} run: | - echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} - - - name: Sign the published Docker image - if: ${{ github.event_name != 'pull_request' }} - env: - TAGS: ${{ steps.meta.outputs.tags }} - DIGEST: ${{ steps.build-and-push.outputs.digest }} - run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} \ No newline at end of file + echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} \ No newline at end of file From 686f753f6126ab9aa13f6326e421d609c4bd1861 Mon Sep 17 00:00:00 2001 From: GamerVII-NET Date: Sat, 25 Oct 2025 09:00:38 +0300 Subject: [PATCH 4/4] =?UTF-8?q?=D0=9E=D0=B1=D0=BD=D0=BE=D0=B2=D0=BB=D0=B5?= =?UTF-8?q?=D0=BD=20workflow=20=D0=BF=D1=83=D0=B1=D0=BB=D0=B8=D0=BA=D0=B0?= =?UTF-8?q?=D1=86=D0=B8=D0=B8=20Docker-=D0=BE=D0=B1=D1=80=D0=B0=D0=B7?= =?UTF-8?q?=D0=BE=D0=B2:=20=D0=B8=D1=81=D0=BF=D0=BE=D0=BB=D1=8C=D0=B7?= =?UTF-8?q?=D0=BE=D0=B2=D0=B0=D0=BD=D0=B8=D0=B5=20digest=20=D0=B8=D0=B7=20?= =?UTF-8?q?create-manifest.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/docker-package-publish.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docker-package-publish.yml b/.github/workflows/docker-package-publish.yml index 2678341..8e10ac3 100644 --- a/.github/workflows/docker-package-publish.yml +++ b/.github/workflows/docker-package-publish.yml @@ -192,7 +192,7 @@ jobs: - name: Sign image with cosign if: github.event_name != 'pull_request' env: - DIGEST: ${{ steps.build.outputs.digest }} + DIGEST: ${{ steps.create-manifest.outputs.digest }} TAGS: ${{ steps.meta.outputs.tags }} run: | - echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} \ No newline at end of file + echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}