Skip to content

chore(ci): add cosign signing to community image builds #3302

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Fortune-Ndlovu wants to merge 6 commits into
base: main
Choose a base branch
from
+27 −0
Open

chore(ci): add cosign signing to community image builds #3302

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
27f5060
ci: add cosign signing to community image builds
Fortune-Ndlovu Jul 30, 2026
cc49f5a
chore(ci): harden cosign signing step
Fortune-Ndlovu Jul 31, 2026
bbae7ed
chore(ci): resolve digest per-tag and fail on signing errors
Fortune-Ndlovu Jul 31, 2026
de732f7
chore(ci): fix signing gate var and add env validation
Fortune-Ndlovu Jul 31, 2026
55e7a05
chore(ci): remove redundant env var checks from signing step
Fortune-Ndlovu Jul 31, 2026
c05c4f0
chore(ci): fix digest retrieval for cosign signing
Fortune-Ndlovu Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions .github/workflows/next-container-build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -243,7 +243,9 @@ jobs:
permissions:
contents: read
packages: write
id-token: write
env:
HAS_QUAY_AUTH: ${{ vars.QUAY_USERNAME != '' && secrets.QUAY_TOKEN != '' }}
HAS_QUAY_OAUTH: ${{ secrets.QUAY_OAUTH_TOKEN != '' }}
SHORT_SHA: ${{ needs.changes.outputs.short_sha }}
BASE_VERSION: ${{ needs.changes.outputs.base_version }}
Expand All @@ -259,6 +261,9 @@ jobs:
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

- name: Install cosign
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

- name: Create manifest lists and push
run: |
set -euo pipefail
Expand Down Expand Up @@ -300,6 +305,28 @@ jobs:
REGISTRY_ORG: ${{ vars.REGISTRY_ORG }}
OPERATOR_IMAGE_NAME: ${{ vars.OPERATOR_IMAGE_NAME || 'operator' }}

- name: Sign the published images
if: env.HAS_QUAY_AUTH == 'true'
run: |
set -euo pipefail
export REGISTRY_WITH_ORG="${REGISTRY}/${REGISTRY_ORG}"

for image in "${OPERATOR_IMAGE_NAME}" "${OPERATOR_IMAGE_NAME}-catalog"; do

@rm3l rm3l Aug 3, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
for image in "${OPERATOR_IMAGE_NAME}" "${OPERATOR_IMAGE_NAME}-catalog"; do
for image in "${OPERATOR_IMAGE_NAME}" "${OPERATOR_IMAGE_NAME}-bundle" "${OPERATOR_IMAGE_NAME}-catalog"; do

Is the bundle image intentionally excluded?

for tag in "${BASE_VERSION}" "${BASE_VERSION}-${SHORT_SHA}" "${LATEST_NEXT}"; do
FULL_REF="${REGISTRY_WITH_ORG}/${image}:${tag}"
DIGEST=$(docker buildx imagetools inspect "$FULL_REF" | grep '^Digest:' | awk '{print $2}')
if [ -z "$DIGEST" ] || [ "$DIGEST" = "null" ]; then
echo "::error::Could not resolve digest for ${FULL_REF}"
exit 1
fi
echo "Signing ${FULL_REF}@${DIGEST}"
cosign sign --yes "${FULL_REF}@${DIGEST}"
done
done
env:
REGISTRY_ORG: ${{ vars.REGISTRY_ORG }}
OPERATOR_IMAGE_NAME: ${{ vars.OPERATOR_IMAGE_NAME || 'operator' }}

- name: Cleanup per-arch tags
if: env.HAS_QUAY_OAUTH == 'true' && vars.REGISTRY == 'quay.io'
run: |
Expand Down