feat: cosign binaries with goreleaser (#83)

* Update release.yaml - install cosign before goreleaser Signed-off-by: Mathieu Benoit <[email protected]> * Update .goreleaser.yaml - cosign Signed-off-by: Mathieu Benoit <[email protected]> --------- Signed-off-by: Mathieu Benoit <[email protected]>
score-spec · Nov 21, 2024 · 2f64164 · 2f64164
1 parent 408c206
commit 2f64164
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 2 deletions.
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -21,6 +21,8 @@ jobs:
         uses: actions/setup-go@v5
         with:
           go-version-file: 'go.mod'
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v3
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v6
         with:
@@ -48,8 +50,6 @@ jobs:
           tags: |
             ghcr.io/score-spec/score-k8s:${{ github.ref_name }}
             ghcr.io/score-spec/score-k8s:latest
-      - name: Install Cosign
-        uses: sigstore/cosign-installer@v3
       - name: Sign container image
         run: |
           cosign sign --yes ghcr.io/score-spec/score-k8s@${{ steps.build-push-container.outputs.digest }}
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
@@ -41,3 +41,16 @@ brews:
     commit_author:
       name: rachfop
       email: [email protected]
+signs:
+  - cmd: cosign
+    signature: "${artifact}.sig"
+    certificate: "${artifact}.pem"
+    args:
+      - sign-blob
+      - '--oidc-provider=github-actions'
+      - '--output-certificate=${certificate}' 
+      - '--output-signature=${signature}'
+      - '${artifact}'
+      - --yes
+    artifacts: all
+    output: true