ci: fix cosign signing (install fallback, env-style login, portal sign step) #44

Merged

sharang merged 2 commits from ci/cosign-fixes into main 2026-07-22 07:46:33 +00:00

Conversation 0 Commits 2 Files Changed 1

+11 -3

sharang commented 2026-07-22 07:44:01 +00:00

Owner

Copy Link

Copy Source

Fixes three cosign/CI bugs from the Harbor cutover: (1) cosign install used curl, absent in the docker:cli build containers -> 'curl: not found', now curl-or-wget and fully ::warning::-guarded so it can never fail a build; (2) [certifai + compliance-scanner-agent] docker login interpolated the robot username inline — sh expands the '$' in robot$ci-push to 'robot-push' -> unauthorized (this also hard-failed the Deploy Docs job); creds now flow via env. COSIGN_KEY/COSIGN_PASSWORD env was also missing (the injector skipped workflows that already had a top-level env block); (3) [portal] the sign step was never injected (portal uses docker/build-push-action, not a raw docker push) — added it, so portal images finally get signed.

Fixes three cosign/CI bugs from the Harbor cutover: (1) cosign install used curl, absent in the docker:cli build containers -> 'curl: not found', now curl-or-wget and fully ::warning::-guarded so it can never fail a build; (2) [certifai + compliance-scanner-agent] docker login interpolated the robot username inline — sh expands the '$' in robot$ci-push to 'robot-push' -> unauthorized (this also hard-failed the Deploy Docs job); creds now flow via env. COSIGN_KEY/COSIGN_PASSWORD env was also missing (the injector skipped workflows that already had a top-level env block); (3) [portal] the sign step was never injected (portal uses docker/build-push-action, not a raw docker push) — added it, so portal images finally get signed.

sharang added 1 commit 2026-07-22 07:44:01 +00:00

ci: fix cosign install (curl->wget fallback), env-style registry login, portal sign step 75feed2417

sharang added 1 commit 2026-07-22 07:45:29 +00:00

ci: certifai login via env vars too (two-line variant) a2bc551ef9

sharang merged commit 406d5ec2f1 into main 2026-07-22 07:46:33 +00:00

sharang deleted branch ci/cosign-fixes 2026-07-22 07:46:33 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

sharang (Sharang Parnerkar)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/certifai#44