Implement cosign on docker image

.github/workflows/docker.yml

@@ -7,6 +7,7 @@ on:
     tags: ["v*"]
     branches: [ master, main, develop ]
   workflow_dispatch:
+  pull_request:
 
 permissions:
   contents: read
@@ -29,6 +30,9 @@ jobs:
       - name: Inspect builder
         run: docker buildx inspect
 
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v3.3.0
+
       - name: Checkout repository
         uses: actions/checkout@v4
 
@@ -37,7 +41,7 @@ jobs:
         # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsshell
         shell: bash
         run: |
-          echo "SYNAPSE_VERSION=$(grep "^version" pyproject.toml | sed -E 's/version\s*=\s*["]([^"]*)["]/\1/')" >> $GITHUB_ENV
+          echo "SYNAPSE_VERSION=0.0.0" >> $GITHUB_ENV
 
       - name: Log in to DockerHub
         uses: docker/login-action@v3
@@ -57,23 +61,20 @@ jobs:
         uses: docker/metadata-action@master
         with:
           images: |
-            docker.io/matrixdotorg/synapse
             ghcr.io/element-hq/synapse
           flavor: |
             latest=false
           tags: |
-            type=raw,value=develop,enable=${{ github.ref == 'refs/heads/develop' }}
-            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' }}
-            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+            type=raw,value=test-cosign
             type=pep440,pattern={{raw}}
 
       - name: Build and push all platforms
+        id: build-and-push
         uses: docker/build-push-action@v5
         with:
           push: true
           labels: |
             gitsha1=${{ github.sha }}
-            org.opencontainers.image.version=${{ env.SYNAPSE_VERSION }}
           tags: "${{ steps.set-tag.outputs.tags }}"
           file: "docker/Dockerfile"
           platforms: linux/amd64,linux/arm64
@@ -82,3 +83,14 @@ jobs:
           # https://github.com/rust-lang/cargo/issues/10583
           build-args: |
             CARGO_NET_GIT_FETCH_WITH_CLI=true
+
+      - name: Sign the images with GitHub OIDC Token
+        env:
+          DIGEST: ${{ steps.build-and-push.outputs.digest }}
+          TAGS: ${{ steps.set-tag.outputs.tags }}
+        run: |
+          images=""
+          for tag in ${TAGS}; do
+            images+="${tag}@${DIGEST} "
+          done
+          cosign sign --yes ${images}

changelog.d/16774.misc

@@ -0,0 +1 @@
+Sign the published docker image using [cosign](https://docs.sigstore.dev/).