Merge pull request 'ci: fix cosign signing (install fallback, env-style login, portal sign step)' (#18 ) from ci/cosign-fixes into main

ci: fix cosign install (curl->wget fallback), env-style registry login, portal sign step
2026-07-22 07:46:02 +00:00 · 2026-07-22 07:44:16 +00:00
1 changed files with 5 additions and 0 deletions
@@ -137,6 +137,11 @@ jobs:
          tags: |
            repo.meghsakha.com/breakpilot/portal:latest
            repo.meghsakha.com/breakpilot/portal:sha-${{ github.sha }}
+      - name: sign image (cosign)
+        run: |
+          { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
+          chmod +x /usr/local/bin/cosign 2>/dev/null || true
+          cosign sign --yes --key env://COSIGN_KEY repo.meghsakha.com/breakpilot/portal:latest || echo "::warning::cosign failed"
      - name: trigger orca redeploy
        # Signs the POST with HMAC-SHA256 over the JSON body using the
        # secret orca generated when the webhook was registered. Orca's
Author	SHA1	Message	Date
sharang	da6b8f70c5	Merge pull request 'ci: fix cosign signing (install fallback, env-style login, portal sign step)' (#18 ) from ci/cosign-fixes into main ci / shared (push) Failing after 12s Details ci / test (push) Successful in 10m14s Details ci / image (push) Skipped Details ci / e2e (push) Canceled after 0s Details	2026-07-22 07:46:02 +00:00
sharang	a3c1bb075c	ci: fix cosign install (curl->wget fallback), env-style registry login, portal sign step ci / test (pull_request) Successful in 10m20s Details ci / shared (pull_request) Failing after 5s Details ci / image (pull_request) Skipped Details ci / e2e (pull_request) Canceled after 0s Details	2026-07-22 07:44:16 +00:00