Sign and attest Docker Hub image #851
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR adds container image signing using cosign to enhance supply chain security for the published container images. The changes implement keyless signing via GitHub OIDC and provide verification instructions for users.
- Implements cosign signing for container images in the release workflow
- Adds artifact attestation for build provenance
- Documents signature verification process in README
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
.github/workflows/release.yml |
Adds cosign installation, image signing step, artifact attestation, and updates permissions for OIDC token access |
README.md |
Documents how to verify container image signatures using cosign with example commands and adds cosign reference link |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
martincostello
changed the title
Add steps to attest and sign the images pushed to Docker Hub with GitHub Attestations and Cosign.
Make it explicit the command is an example.
martincostello
force-pushed
the
cosign-dockerhub-images
branch
from
b885629 to
664e3eb
Compare
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Also add instructions for CI images pushed to GHCR.
Use a variable to make the URL shorter.
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
2 participants
Add steps to attest and sign the images pushed to Docker Hub with GitHub Attestations and Cosign.