Sign published images with cosign

.github/workflows/dev-publish.yaml

@@ -41,8 +41,8 @@ jobs:
   build:
     name: Build
     permissions:
-      contents: write
       packages: write
+      id-token: write
     needs: preflight
     uses: ./.github/workflows/publish.yaml
     with:

.github/workflows/manual-publish.yaml

@@ -60,6 +60,7 @@ jobs:
     name: Publish
     permissions:
       packages: write
+      id-token: write
     needs: preflight
     uses: ./.github/workflows/publish.yaml
     with:

.github/workflows/publish.yaml

@@ -232,10 +232,13 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       packages: write
+      id-token: write
     steps:
     - uses: actions/checkout@v6
     - name: Install crane
       uses: reconcilerio/install-crane-action@v1
+    - name: Install cosign
+      uses: sigstore/cosign-installer@v4.1.2
     - name: Download staged image
       uses: actions/download-artifact@v8
       with:
@@ -252,6 +255,10 @@ jobs:
         crane push \
           "wasmtime-${{ inputs.tag }}" \
           "${{ env.image }}"
+    - name: Sign
+      run: |
+        cosign sign --yes \
+          "${{ env.image }}"
     - name: Additional tags
       if: inputs.additional-tags
       run: |

.github/workflows/pull-request.yaml

@@ -87,6 +87,7 @@ jobs:
     permissions:
       # called workflow requires write even though it's never used from here
       packages: write
+      id-token: write
     needs: preflight
     strategy:
       fail-fast: false

.github/workflows/push.yaml

@@ -76,6 +76,7 @@ jobs:
     name: Publish
     permissions:
       packages: write
+      id-token: write
     needs: preflight
     strategy:
       fail-fast: false