ci: fix cosign signing (install fallback, env-style login, portal sign step) (#44)

.gitea/workflows/ci.yml

@@ -9,6 +9,13 @@ on:
       - main
 
 env:
+  # registry + cosign creds via env, NOT inline ${{ }}: the Harbor robot
+  # username contains '$', which sh expands when interpolated into the
+  # script (robot$ci-push -> robot-push) => docker login unauthorized.
+  REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+  REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+  COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
+  COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
   CARGO_TERM_COLOR: always
   RUSTFLAGS: "-D warnings"
   # sccache caches compilation artifacts within a job so that compiling
@@ -274,11 +281,12 @@ jobs:
       - name: Build and push image
         run: |
           IMAGE=repo.meghsakha.com/certifai/certifai-dashboard
-          echo "${{ secrets.REGISTRY_PASSWORD }}" | \
-            docker login repo.meghsakha.com -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          echo "$REGISTRY_PASSWORD" | \
+            docker login repo.meghsakha.com -u "$REGISTRY_USERNAME" --password-stdin
           docker build -t "$IMAGE:latest" -t "$IMAGE:${GITHUB_SHA}" .
           docker push "$IMAGE:latest"
-          command -v cosign >/dev/null 2>&1 || { curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 && chmod +x /usr/local/bin/cosign; }
+          { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
+          chmod +x /usr/local/bin/cosign 2>/dev/null || true
           cosign sign --yes --key env://COSIGN_KEY "$IMAGE:latest" || echo "::warning::cosign failed"
           docker push "$IMAGE:${GITHUB_SHA}"
       - name: Trigger orca redeploy