sign.yaml

name: Sign container image

on:
  workflow_run:
    workflows: ["Build and push images"]
    types:
      - completed
  workflow_dispatch:
  push:

jobs:
  sign:
    name: Create attestation
    runs-on: ubuntu-22.04
    strategy:
      matrix:
        version: ['3.2']
    permissions:
      packages: write
    steps:
      - name: Login to GHCR
        uses: docker/login-action@v3.0.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: sigstore/cosign-installer@v3.3.0
      - uses: anchore/sbom-action/download-syft@v0
        id: syft
      - name: Create attestation
        run: |
          BASE_IMAGE='ghcr.io/alphagov/govuk-ruby-base:${{ matrix.version }}'
          BUILDER_IMAGE='ghcr.io/alphagov/govuk-ruby-builder:${{ matrix.version }}'
          SYFT='${{steps.syft.outputs.cmd }}'

          $SYFT --output spdx-json "${BASE_IMAGE}" > base.spdx.json
          $SYFT --output spdx-json "${BUILDER_IMAGE}" > builder.spdx.json

          cosign attest --predicate base.spdx.json --key "awskms:///alias/container-signing-key" "${BASE_IMAGE}"
          cosign attest --predicate builder.spdx.json --key "awskms:///alias/container-signing-key" "${BUILDER_IMAGE}"