cluster

commit 215fa9171436c01c239f348324bb2057f003a191
parent c1acdfe3c3fb8e1c181adc9edc82a5767fde2db4
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Wed, 25 Mar 2026 20:06:47 +0100

cosign the images

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
M
.github/workflows/build-continuwuity.yaml
 | 
13
+++++++++++++
M
.gitignore
 | 
1
+
A
cosign.pub
 | 
4
++++

3 files changed, 18 insertions(+), 0 deletions(-)
diff --git a/.github/workflows/build-continuwuity.yaml b/.github/workflows/build-continuwuity.yaml
@@ -47,7 +47,11 @@ jobs:
             type=raw,value=main
             type=sha,prefix=sha-
 
+      - name: Install cosign
+        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
+
       - name: Build and push
+        id: build
         uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
         with:
           context: apps/talos_cluster/continuwuity
@@ -58,3 +62,12 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           platforms: linux/amd64,linux/arm64
+
+      - name: Sign image
+        env:
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
+          DIGEST: ${{ steps.build.outputs.digest }}
+        run: |
+          cosign sign --key env://COSIGN_PRIVATE_KEY \
+            registry.midnightthoughts.space/mtrnord/cluster/continuwuity@${DIGEST}
diff --git a/.gitignore b/.gitignore
@@ -6,3 +6,4 @@ homeserver_config.yaml
 mas_configfile.yaml
 gerrit_key*
 *.private-key.pem
+cosign.key
diff --git a/cosign.pub b/cosign.pub
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEOpUp7l1T+CPFS3BhcBv9DQXNXJtK
+p87SB7ZXZL5FactrIJ9Ezx1dhIWEB5YJmrXHowKksl1I7iwGpb13rFnGNQ==
+-----END PUBLIC KEY-----