cluster

commit b608aa81b442951133602d04d6de6df90ff9a8ac
parent 7e346ae0933b78bdd3c66982144d593e10768969
Author: MTRNord <MTRNord@users.noreply.github.com>
Date:   Thu, 26 Mar 2026 00:08:35 +0100

fix signing properly

Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>

Diffstat:
M
.github/workflows/build-blog.yaml
 | 
6
++++--
M
.github/workflows/build-bookwyrm.yaml
 | 
8
+++++---
M
.github/workflows/build-continuwuity.yaml
 | 
6
++++--

3 files changed, 13 insertions(+), 7 deletions(-)
diff --git a/.github/workflows/build-blog.yaml b/.github/workflows/build-blog.yaml
@@ -36,7 +36,7 @@ jobs:
           password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1
+        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
 
       - name: Extract metadata
         id: meta
@@ -71,7 +71,9 @@ jobs:
           COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
           COSIGN_OCI_EXPERIMENTAL: "1"
           COSIGN_EXPERIMENTAL: "1"
+          DIGEST: ${{ steps.build.outputs.digest }}
         run: |
           cosign sign --yes --key env://COSIGN_PRIVATE_KEY \
+            --new-bundle-format=false \
             --registry-referrers-mode=oci-1-1 \
-            registry.midnightthoughts.space/mtrnord/blog:latest
+            "registry.midnightthoughts.space/mtrnord/blog@${DIGEST}"
diff --git a/.github/workflows/build-bookwyrm.yaml b/.github/workflows/build-bookwyrm.yaml
@@ -103,9 +103,10 @@ jobs:
           password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1
+        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
 
       - name: Build and push
+        id: build
         uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
         with:
           context: .
@@ -128,8 +129,9 @@ jobs:
           COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
           COSIGN_OCI_EXPERIMENTAL: "1"
           COSIGN_EXPERIMENTAL: "1"
-          NEW_VERSION: ${{ needs.check.outputs.new_version }}
+          DIGEST: ${{ steps.build.outputs.digest }}
         run: |
           cosign sign --yes --key env://COSIGN_PRIVATE_KEY \
+            --new-bundle-format=false \
             --registry-referrers-mode=oci-1-1 \
-            "registry.midnightthoughts.space/mtrnord/bookwyrm:${NEW_VERSION}"
+            "registry.midnightthoughts.space/mtrnord/bookwyrm@${DIGEST}"
diff --git a/.github/workflows/build-continuwuity.yaml b/.github/workflows/build-continuwuity.yaml
@@ -53,7 +53,7 @@ jobs:
             type=sha,prefix=sha-
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1
+        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
 
       - name: Build and push
         id: build
@@ -74,7 +74,9 @@ jobs:
           COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
           COSIGN_OCI_EXPERIMENTAL: "1"
           COSIGN_EXPERIMENTAL: "1"
+          DIGEST: ${{ steps.build.outputs.digest }}
         run: |
           cosign sign --yes --key env://COSIGN_PRIVATE_KEY \
+            --new-bundle-format=false \
             --registry-referrers-mode=oci-1-1 \
-            registry.midnightthoughts.space/mtrnord/cluster/continuwuity:main
+            "registry.midnightthoughts.space/mtrnord/cluster/continuwuity@${DIGEST}"