Disable cosign on PRs in Docker image workflow

[Copilot]

Problem

The Docker image workflow was failing on pull requests because cosign was attempting to sign images that were never pushed to the registry. While the Docker registry push and attestation steps were already conditional (if: github.event_name != 'pull_request'), the cosign steps were running unconditionally, causing failures due to invalid tags being passed.

Solution

Added the if: github.event_name != 'pull_request' condition to all three cosign-related steps:

1. Install cosign - Skip installation on PRs
2. Check cosign installation - Skip version check on PRs
3. Sign the images with GitHub OIDC Token - Skip signing on PRs

This ensures cosign is entirely disabled on pull requests, consistent with the existing behavior for Docker registry operations.

Workflow Behavior

The Docker job now has consistent conditional logic:

Step	Runs on PRs?
Build Docker image	✅ Yes (but doesn't push)
Log into registry	❌ No
Push to registry	❌ No
Attest build provenance	❌ No
Install cosign	❌ No
Check cosign	❌ No
Sign images	❌ No

On PRs, the workflow will build the Docker image for validation but skip all registry interactions and signing operations.

Fixes the issue where cosign was failing on PRs with invalid tag references.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Disable cosign on PRs in Docker image workflow</issue_title>
<issue_description>Failing because of the passed tag.

Cosign should be entirely disabled on PRs, just like the push to registry.</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes #33

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
fluorite	Ready	Preview	Comment	Oct 13, 2025 1:09pm