ci: sign images with cosign

[kharf]

Summary by cubic

Sign container images with cosign in the release workflow to enable verification and provenance. Uses GitHub OIDC for keyless signing and signs all published tags across registries.

• New Features

  • Grant id-token: write in the release workflow for keyless signing.
  • Install cosign via sigstore/cosign-installer (version read from COSIGN_VERSION in the Makefile) and run make sign after make publish.
  • Add Makefile targets: sign for main, -ubi, -fips, and config-reloader (incl. -fips) across $(PUBLISH_REGISTRIES), and cosign to bootstrap the binary via COSIGN_BIN.
  • Resolve COSIGN from PATH when available, falling back to the bootstrapped binary.

• Dependencies

  • Add sigstore/cosign-installer@v4.1.1; default COSIGN_VERSION is v3.0.6.
  • Teach Renovate to track COSIGN_VERSION in the Makefile.

^{Written for commit 1437fa0. Summary will update on new commits.}

[vrutkovs]

That looks useful, thank you

[vrutkovs]

I'd prefer an approach which installs cosign binary in case we run this locally:

Suggested change

	sign:
	COSIGN_VERSION ?= v3.0.6
	COSIGN_BIN ?= $(LOCALBIN)/cosign-$(COSIGN_VERSION)
	.PHONY: cosign
	cosign: $(COSIGN_BIN)
	$(COSIGN_BIN): $(LOCALBIN)
	$(call download-github-release,$(COSIGN_BIN),sigstore/cosign,$(COSIGN_VERSION),cosign-$(OS)-$(ARCH),cosign-$(OS)-$(ARCH))
	sign: cosign

This also needs a renovate.json to keep the version updated:

    {
      "customType": "regex",
      "managerFilePatterns": [
        "/^Makefile$/"
      ],
      "matchStrings": [
        "COSIGN_VERSION \\?= (?<currentValue>v.*)"
      ],
      "datasourceTemplate": "github-releases",
      "depNameTemplate": "sigstore/cosign"
    }

[kharf]

Sure I can do that! Just curious: when or why would you run this locally? This could break verification when expecting the gh action oidc issuer

[vrutkovs]

I'd prefer not to get tied to Github Actions (in case we swap CIs later) and use custom keypair instead. Also more cosign actions may be added later (i.e. verify).

Perhaps a makefile target could be used as an emergency fallback, so lets keep github actions too.

[kharf]

Ok so I kept the github action and added the requested changes. It got a bit ugly, because I want to use the same cosign version for the github action. This could get flaky though, when the makefile variable gets changed. I could also specify the version directly and add it to the renovate regex manager.

What do you say?

[vrutkovs]

Yeah, that looks great! We'll be keeping an eye on this - if this method becomes too brittle we'll probably have to drop Makefile entry then.

Thank you!

[cubic-dev-ai]

1 issue found across 3 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="Makefile">

<violation number="1" location="Makefile:282">
P1: `sign` target's config-reloader image paths don't match `publish` output: `publish` pushes config-reloader images under the `operator` repo (missing `REPO=config-reloader`), but `sign` expects them under the `config-reloader` repo</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[vrutkovs]

Thank you for your contribution!