Cosign Docker images with GitHub OIDC

Author: AFCMS

.github/workflows/ci.yml

@@ -170,3 +170,20 @@ jobs:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.build-and-push.outputs.digest }}
           push-to-registry: false
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3
+
+      - name: Check cosign installation
+        run: cosign version
+
+      - name: Sign the images with GitHub OIDC Token
+        env:
+          DIGEST: ${{ steps.build-and-push.outputs.digest }}
+          TAGS: ${{ steps.meta.outputs.tags }}
+        run: |
+          images=""
+          for tag in ${TAGS}; do
+            images+="${tag}@${DIGEST} "
+          done
+          cosign sign --yes ${images}