From 6f2683540a9b3512228158b4824d117484c9c0ec Mon Sep 17 00:00:00 2001
From: Stephen Fox Jr <sfoxjr@equinix.com>
Date: Fri, 8 Dec 2023 11:37:43 -0500
Subject: [PATCH] ci: Use cosign to sign container images.

This commit adds cosign to the CI pipeline. cosign is an open-source
tool developed by Chainguard that signs container images, allowing
other users to cryptographically verify the origin of container
images. [1]

cosign has different operating modes. This commit utilizes Chainguard's
signing infrastructure via "keyless signing". [2] Keyless signing makes
image signing easy for open-source projects because Chainguard operates
the signing infrastructure on behalf of others.

Note: This commit is based on work by Chris Nesbitt-Smith, who published
an example GitHub Actions workflow for running cosign. [3]

References

1. https://docs.sigstore.dev/signing/quickstart
2. https://edu.chainguard.dev/open-source/sigstore/cosign/an-introduction-to-cosign/#keyless-signing
3. https://github.com/chrisns/cosign-keyless-demo/blob/f35f6c776f/.github/workflows/ci.yml
---
 .github/workflows/release.yml | 47 +++++++++++++++++++++++++++--------
 1 file changed, 36 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c98c24f..e4b65fd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,13 +1,11 @@
 
 name: Create and publish a api image
 
-on:
-  push:
-    tags:
-      - v**
+on: push
+
 env:
   REGISTRY: ghcr.io/metal-toolbox
-  API_IMAGE_NAME: audito-maldito/audito-maldito
+  APP_IMAGE_NAME: audito-maldito/audito-maldito
 
 jobs:
   auto-release:
@@ -29,6 +27,7 @@ jobs:
     permissions:
       contents: read
       packages: write
+      id-token: write # needed for signing the images with GitHub OIDC Token
 
     steps:
       - name: Checkout repository
@@ -41,6 +40,10 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - uses: sigstore/cosign-installer@v3.1.1
+        with:
+          cosign-release: "v2.2.1"
+
       - name: Get current date
         id: date
         run: echo "::set-output name=date::$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
@@ -49,21 +52,43 @@ jobs:
         id: meta-api
         uses: docker/metadata-action@62339db73c56dd749060f65a6ebb93a6e056b755
         with:
-          images: ${{ env.REGISTRY }}/${{ env.API_IMAGE_NAME }}
+          images: ${{ env.REGISTRY }}/${{ env.APP_IMAGE_NAME }}
 
       - name: Build rsyslog and push Docker image
-        uses: docker/build-push-action@fdf7f43ecf7c1a5c7afe936410233728a8c2d9c2
+        id: rsyslog-build-push
+        uses: docker/build-push-action@v5.1.0
         with:
           context: "./contrib/rsyslog"
           push: true
           file: ./contrib/rsyslog/Dockerfile.ubuntu
-          tags: ${{ env.REGISTRY }}/${{ env.API_IMAGE_NAME }}:${{ github.ref_name }}-rsyslog
+          tags: ${{ env.REGISTRY }}/${{ env.APP_IMAGE_NAME }}:${{ github.ref_name }}-rsyslog
           labels: ${{ steps.meta-api.outputs.labels }}
 
+      - name: Get rsyslog container info
+        id: rsyslog-image-info
+        run: |
+          image_digest="$(docker inspect "${{ env.REGISTRY }}/${{ env.APP_IMAGE_NAME }}:${{ github.ref_name }}-rsyslog" --format '{{ index .RepoDigests 0 }}' | awk -F '@' '{ print $2 }')"
+          echo "::set-output name=image-digest::${image_digest}"
+
+      - run: cosign version && cosign sign -y -r ${TARGET_IMAGE}
+        env:
+          TARGET_IMAGE: ${{ steps.rsyslog-image-info.outputs.image-digest }}
+
       - name: Build and push Docker image
-        uses: docker/build-push-action@fdf7f43ecf7c1a5c7afe936410233728a8c2d9c2
+        id: am-build-push
+        uses: docker/build-push-action@v5.1.0
         with:
           push: true
           file: Dockerfile
-          tags: ${{ env.REGISTRY }}/${{ env.API_IMAGE_NAME }}:${{ github.ref_name }}
-          labels: ${{ steps.meta-api.outputs.labels }}
\ No newline at end of file
+          tags: ${{ env.REGISTRY }}/${{ env.APP_IMAGE_NAME }}:${{ github.ref_name }}
+          labels: ${{ steps.meta-api.outputs.labels }}
+
+      - name: Get am container info
+        id: am-image-info
+        run: |
+          image_digest="$(docker inspect "${{ env.REGISTRY }}/${{ env.APP_IMAGE_NAME }}:${{ github.ref_name }}" --format '{{ index .RepoDigests 0 }}' | awk -F '@' '{ print $2 }')"
+          echo "::set-output name=image-digest::${image_digest}"
+
+      - run: cosign sign -y -r ${TARGET_IMAGE}
+        env:
+          TARGET_IMAGE: ${{ steps.am-image-info.outputs.image-digest }}