build: sign docker images

Signed-off-by: Jakob Borg <jakob@kastelo.net>
2026-05-27 17:32:05 +02:00
2 changed files with 30 additions and 2 deletions
@@ -15,6 +15,7 @@ env:
 permissions:
  contents: read
  packages: write
+  id-token: write

 jobs:
  docker-syncthing:
@@ -30,11 +31,11 @@ jobs:
          - stupgrades
          - ursrv
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # was: actions/checkout@v5
        with:
          fetch-depth: 0

-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # was: actions/setup-go@v6
        with:
          go-version: ${{ env.GO_VERSION }}
          check-latest: true
@@ -77,6 +78,7 @@ jobs:
          echo "TAGS=$tags" >> $GITHUB_ENV

      - name: Build and push
+        id: build
        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
        with:
          context: .
@@ -86,3 +88,11 @@ jobs:
          tags: ${{ env.TAGS }}
          labels: |
            org.opencontainers.image.revision=${{ github.sha }}
+
+      - name: Install Cosign
+        if: github.ref == 'refs/heads/infrastructure'
+        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
+
+      - name: Sign image
+        if: github.ref == 'refs/heads/infrastructure'
+        run: cosign sign --yes --recursive ghcr.io/syncthing/infra/${{ matrix.pkg }}:latest@${{ steps.build.outputs.digest }}
@@ -1012,6 +1012,7 @@ jobs:
    permissions:
      contents: read
      packages: write
+      id-token: write
    needs:
      - facts
    env:
@@ -1115,6 +1116,7 @@ jobs:
          mv bin/* script ctx

      - name: Build and push Docker image
+        id: build
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: ctx
@@ -1126,6 +1128,22 @@ jobs:
            org.opencontainers.image.version=${{ env.VERSION }}
            org.opencontainers.image.revision=${{ github.sha }}

+      - name: Install Cosign
+        if: github.event_name == 'push'
+        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
+
+      - name: Sign image
+        if: github.event_name == 'push'
+        env:
+          DIGEST: ${{ steps.build.outputs.digest }}
+        run: |
+          IFS="," read -ra tags <<< $DOCKER_TAGS
+          images=""
+          for tag in ${tags[@]}; do
+            images+="${tag}@${DIGEST} "
+          done
+          cosign sign --yes --recursive ${images}
+
  #
  # Sync images to Docker hub. This takes the images already pushed to GHCR
  # and copies them to Docker hub. Runs for releases only.