ci: fix cosign install (curl->wget fallback), env-style registry login, portal sign step

2026-07-22 07:44:16 +00:00
parent af13f054e4
commit a3c1bb075c
1 changed files with 5 additions and 0 deletions
@@ -137,6 +137,11 @@ jobs:
          tags: |
            repo.meghsakha.com/breakpilot/portal:latest
            repo.meghsakha.com/breakpilot/portal:sha-${{ github.sha }}
+      - name: sign image (cosign)
+        run: |
+          { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
+          chmod +x /usr/local/bin/cosign 2>/dev/null || true
+          cosign sign --yes --key env://COSIGN_KEY repo.meghsakha.com/breakpilot/portal:latest || echo "::warning::cosign failed"
      - name: trigger orca redeploy
        # Signs the POST with HMAC-SHA256 over the JSON body using the
        # secret orca generated when the webhook was registered. Orca's