From a3c1bb075c9d8adb7368e865a9a66d67eb78416b Mon Sep 17 00:00:00 2001 From: Sharang Parnerkar Date: Wed, 22 Jul 2026 07:44:16 +0000 Subject: [PATCH] ci: fix cosign install (curl->wget fallback), env-style registry login, portal sign step --- .gitea/workflows/ci.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 4dc85a5..a9435a8 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -137,6 +137,11 @@ jobs: tags: | repo.meghsakha.com/breakpilot/portal:latest repo.meghsakha.com/breakpilot/portal:sha-${{ github.sha }} + - name: sign image (cosign) + run: | + { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed" + chmod +x /usr/local/bin/cosign 2>/dev/null || true + cosign sign --yes --key env://COSIGN_KEY repo.meghsakha.com/breakpilot/portal:latest || echo "::warning::cosign failed" - name: trigger orca redeploy # Signs the POST with HMAC-SHA256 over the JSON body using the # secret orca generated when the webhook was registered. Orca's -- 2.54.0