fix(gha): cosign signing is not only done on sha digest, rather than …

…tags, e.g. latest, vX.X.X etc
opencadc · Nov 22, 2024 · 9cfc1f5 · 9cfc1f5
1 parent 807e5f5
commit 9cfc1f5
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 3 deletions.
diff --git a/.github/workflows/cd.edge.build.yml b/.github/workflows/cd.edge.build.yml
@@ -78,4 +78,4 @@ jobs:
         id: cosign
         run: |
           cosign version
-          cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ env.TAG }} --upload
+          cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ steps.build.outputs.digest }} --upload
diff --git a/.github/workflows/cd.release.build.yml b/.github/workflows/cd.release.build.yml
@@ -84,6 +84,4 @@ jobs:
         id: cosign
         run: |
           cosign version
-          cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ env.TAG }} --upload
-          cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ env.TAG_RELEASE }} --upload
           cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ steps.build.outputs.digest }} --upload