@@ -40,21 +40,21 @@ jobs:
4040
4141 steps :
4242 - name : Checkout repository
43- uses : actions/checkout@v7
43+ uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
4444
4545 # Install the cosign tool except on PR
4646 # https://github.com/sigstore/cosign-installer
4747 - name : Install cosign
4848 if : github.event_name != 'pull_request'
4949 uses : sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
5050 with :
51- cosign-release : " v2.2.4 "
51+ cosign-release : " v3.1.3 "
5252
5353 # Set up BuildKit Docker container builder to be able to build
5454 # multi-platform images and export cache
5555 # https://github.com/docker/setup-buildx-action
5656 - name : Set up Docker Buildx
57- uses : docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
57+ uses : docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
5858
5959 # Login against a Docker registry except on PR
6060 # https://github.com/docker/login-action
8787 type=raw,value=latest,enable=${{ github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-') }}
8888
8989name : Go Build Cache for Docker
90- uses : actions/cache@v6
90+ uses : actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
9191 with :
9292 path : go-build-cache
9393 key : ${{ runner.os }}-go-build-cache-${{ hashFiles('**/go.sum') }}
@@ -106,7 +106,7 @@ jobs:
106106 # https://github.com/docker/build-push-action
107107 - name : Build and push Docker image
108108 id : build-and-push
109- uses : docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3 .0
109+ uses : docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4 .0
110110 with :
111111 context : .
112112 push : ${{ github.event_name != 'pull_request' }}
@@ -116,23 +116,26 @@ jobs:
116116 cache-to : type=gha,mode=max
117117 platforms : linux/amd64,linux/arm64
118118 build-args : |
119- VERSION=${{ github.ref_name }}
119+ VERSION=${{ github.ref_type == 'tag' && github. ref_name || 'dev' }}
120120secrets : |
121121 oauth_client_id=${{ secrets.OAUTH_CLIENT_ID }}
122122 oauth_client_secret=${{ secrets.OAUTH_CLIENT_SECRET }}
123123
124124# Sign the resulting Docker image digest except on PRs.
125- # This will only write to the public Rekor transparency log when the Docker
126- # repository is public to avoid leaking data. If you would like to publish
127- # transparency data even for private images, pass --force to cosign below.
125+ # Publish both v2-compatible .sig tags and native Sigstore bundles.
126+ # --yes also consents to publishing signing metadata to the public log.
128127 # https://github.com/sigstore/cosign
129- - name : Sign the published Docker image
128+ - name : Sign the published Docker image (legacy)
130129 if : ${{ github.event_name != 'pull_request' }}
131130 env :
132131 # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
133- TAGS : ${{ steps.meta.outputs.tags }}
134132 DIGEST : ${{ steps.build-and-push.outputs.digest }}
135133 # This step uses the identity token to provision an ephemeral certificate
136134 # against the sigstore community Fulcio instance.
137- run : echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
138-
135+ run : cosign sign --yes --new-bundle-format=false --use-signing-config=false --registry-referrers-mode=legacy "${REGISTRY}/${IMAGE_NAME}@${DIGEST}"
136+
137+ - name : Sign the published Docker image (native bundle)
138+ if : ${{ github.event_name != 'pull_request' }}
139+ env :
140+ DIGEST : ${{ steps.build-and-push.outputs.digest }}
141+ run : cosign sign --yes "${REGISTRY}/${IMAGE_NAME}@${DIGEST}"
0 commit comments