Signing artifacts with cosign #40

	name: scan-sign

	on:
	push:
	branches:
	- "**"

	permissions:
	contents: read

	env:
	TRIVY_VEX: ./cves/cve-medium.json
	IMAGE: ttl.sh/knabben/doc-poc

	jobs:
	tests:
	uses: ./.github/workflows/test.yml
	build:
	outputs:
	image: ${{ steps.build.outputs.image }}
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	- name: Build image
	id: build
	run: \|
	image=${IMAGE}:${GITHUB_SHA}
	docker build -t ${image} .
	docker push ${image}
	echo "image=${image}" >> $GITHUB_OUTPUT
	scan-sign:
	runs-on: ubuntu-latest
	needs: [build]
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	- name: Run Trivy vulnerability scanner
	id: scan
	uses: aquasecurity/trivy-action@master
	with:
	image-ref: ${{ needs.build.outputs.image }}
	format: cyclonedx
	ignore-unfixed: true
	vuln-type: os,library
	severity: CRITICAL,HIGH
	scanners: 'vuln'
	output: 'project.sbom.json'
	- name: Upload trivy report as a Github artifact
	id: upload
	uses: actions/upload-artifact@v4
	with:
	name: trivy-sbom-report
	path: '${{ github.workspace }}/project.sbom.json'
	retention-days: 1
	- name: Install Cosign
	uses: sigstore/cosign-installer@v3.4.0
	- name: Sign image with Private KEY
	id: sign
	run: \|
	echo "$COSIGN_KEY" > /tmp/cosign.key
	cosign sign -key /tmp/cosign.key ${{ needs.build.outputs.image }} --yes
	env:
	COSIGN_KEY: ${{secrets.COSIGN_KEY}}

Provide feedback