From b93ed01b5fc19962ca324748ed640009ad51064b Mon Sep 17 00:00:00 2001 From: BryanFRD Date: Sun, 20 Sep 2026 17:22:54 +0200 Subject: [PATCH] fix(ci): sign the image even when the CVE scan fails --- .github/workflows/reusable-docker-build.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/reusable-docker-build.yml b/.github/workflows/reusable-docker-build.yml index a8aebaa..ebce6f6 100644 --- a/.github/workflows/reusable-docker-build.yml +++ b/.github/workflows/reusable-docker-build.yml @@ -462,7 +462,12 @@ jobs: cosign: name: cosign (sign + attest) - needs: [build, trivy] + # Deliberately not gated on `trivy`. The image is already pushed by the + # time the scan runs, so a failing scan does not withhold the artefact, + # only its signature, and consumers end up with an unsigned image that + # shipped anyway. A signature attests provenance, not the absence of + # CVEs; the scan keeps its own red check. See FerrTrack-Cloud#712. + needs: build if: inputs.push # cosign from its static binary (not cosign-installer, which needs # envsubst/gettext absent from the minimal ARC image) so signing runs on the