platform/portal
2
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

CI: sign portal images with cosign (build-push-action needs pushed digest) #17

New Issue
Open
opened 2026-07-21 11:06:29 +00:00 by sharang · 0 comments
sharang commented 2026-07-21 11:06:29 +00:00
Owner
Copy Link
Copy Source

Follow-up to #16, which repointed portal's CI image push from registry.meghsakha.com to Harbor (repo.meghsakha.com).

Cosign signing was not added in that PR: portal builds via docker/build-push-action, so there is no plain docker push <img>:latest line to append a cosign sign step to. Signing needs the pushed image digest (the build-push-action outputs.digest) wired into a dedicated cosign step.

Task

  • Give the build-push-action step an id (e.g. id: build)
  • Add a cosign step: cosign sign --yes --key env://COSIGN_KEY repo.meghsakha.com/breakpilot/portal@${{ steps.build.outputs.digest }}
  • Reuse the existing COSIGN_KEY / COSIGN_PASSWORD repo secrets (already set)
  • Keep it non-fatal (|| echo "::warning::cosign failed") to match the other 4 CI repos

Once done, portal joins certifai / compliance / breakpilot-* in producing signed images, enabling the Orca verified-pull policy (orca#147).

Follow-up to #16, which repointed portal's CI image push from `registry.meghsakha.com` to Harbor (`repo.meghsakha.com`). Cosign signing was **not** added in that PR: portal builds via `docker/build-push-action`, so there is no plain `docker push <img>:latest` line to append a `cosign sign` step to. Signing needs the **pushed image digest** (the build-push-action `outputs.digest`) wired into a dedicated cosign step. ### Task - [ ] Give the build-push-action step an `id` (e.g. `id: build`) - [ ] Add a cosign step: `cosign sign --yes --key env://COSIGN_KEY repo.meghsakha.com/breakpilot/portal@${{ steps.build.outputs.digest }}` - [ ] Reuse the existing `COSIGN_KEY` / `COSIGN_PASSWORD` repo secrets (already set) - [ ] Keep it non-fatal (`|| echo "::warning::cosign failed"`) to match the other 4 CI repos Once done, portal joins certifai / compliance / breakpilot-* in producing signed images, enabling the Orca verified-pull policy (orca#147).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
Benjamin_Boenisch sharang (Sharang Parnerkar)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: platform/portal#17