Allow tokens to be saved for cosign, and always answer yes. (#450)

Signed-off-by: Caleb Brown <[email protected]>
ossf · Mar 20, 2024 · e5e8b33 · e5e8b33
1 parent d7fc358
commit e5e8b33
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -20,6 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       packages: write
+      id-token: write
       contents: read
 
     steps:
@@ -79,4 +80,4 @@ jobs:
 
       - name: Sign the image
         run: |
-          cosign sign ghcr.io/${{ github.repository }}/${{ env.IMAGE_NAME }}@${{ steps.image-build.outputs.digest }}
+          cosign sign --yes ghcr.io/${{ github.repository }}/${{ env.IMAGE_NAME }}@${{ steps.image-build.outputs.digest }}