From 0cdefc82241154bcf5c00735b1a5abcf3570e28f Mon Sep 17 00:00:00 2001
From: averevki <sandyverevkin@gmail.com>
Date: Tue, 30 Jun 2026 19:29:15 +0200
Subject: [PATCH] Add cosigning and provenance attestation to image builds

Signed-off-by: averevki <sandyverevkin@gmail.com>
---
 .github/workflows/build-images-base.yaml      | 21 ++++++++++++++++---
 .github/workflows/build-images-branches.yaml  |  3 +++
 .../build-images-for-tag-release.yaml         |  3 +++
 .github/workflows/build-images-main.yaml      |  3 +++
 .github/workflows/build-images-nightly.yaml   |  3 +++
 5 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build-images-base.yaml b/.github/workflows/build-images-base.yaml
index dcd8d3d9..b92d6b54 100644
--- a/.github/workflows/build-images-base.yaml
+++ b/.github/workflows/build-images-base.yaml
@@ -112,11 +112,16 @@ jobs:
             DIRTY=false
             DEFAULT_AUTHORINO_IMAGE=${{ inputs.relatedImageAuthorino }}
             QUAY_IMAGE_EXPIRY=${{ inputs.quayImageExpiry }}
-          provenance: false
+          provenance: true
       - name: Print image URL
         run: |
           echo "Image(s) pushed:"
           echo "${{ steps.meta.outputs.tags }}"
+      - name: Install cosign
+        uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # ratchet:sigstore/cosign-installer@v3
+      - name: Sign image with cosign
+        run: |
+          cosign sign --yes ${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/${{ env.OPERATOR_NAME }}@${{ steps.build-image.outputs.digest }}
 
   build-bundle:
     name: Build and push bundle image
@@ -189,11 +194,16 @@ jobs:
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           build-args: QUAY_IMAGE_EXPIRY=${{ inputs.quayImageExpiry }}
-          provenance: false
+          provenance: true
       - name: Print image URL
         run: |
           echo "Image(s) pushed:"
           echo "${{ steps.meta.outputs.tags }}"
+      - name: Install cosign
+        uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # ratchet:sigstore/cosign-installer@v3
+      - name: Sign image with cosign
+        run: |
+          cosign sign --yes ${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/${{ env.OPERATOR_NAME }}-bundle@${{ steps.build-image.outputs.digest }}
 
   build-catalog:
     name: Build and push catalog image
@@ -238,8 +248,13 @@ jobs:
           platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
           push: true
           tags: ${{ steps.meta.outputs.tags }}
-          provenance: false
+          provenance: true
       - name: Print image URL
         run: |
           echo "Image(s) pushed:"
           echo "${{ steps.meta.outputs.tags }}"
+      - name: Install cosign
+        uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # ratchet:sigstore/cosign-installer@v3
+      - name: Sign image with cosign
+        run: |
+          cosign sign --yes ${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/${{ env.OPERATOR_NAME }}-catalog@${{ steps.build-image.outputs.digest }}
diff --git a/.github/workflows/build-images-branches.yaml b/.github/workflows/build-images-branches.yaml
index f392880d..b177c6ab 100644
--- a/.github/workflows/build-images-branches.yaml
+++ b/.github/workflows/build-images-branches.yaml
@@ -10,6 +10,9 @@ on:
 jobs:
   build-branches:
     name: Calls build-images-base workflow
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/build-images-base.yaml
     secrets: inherit
     with:
diff --git a/.github/workflows/build-images-for-tag-release.yaml b/.github/workflows/build-images-for-tag-release.yaml
index 3b04d200..508dde80 100644
--- a/.github/workflows/build-images-for-tag-release.yaml
+++ b/.github/workflows/build-images-for-tag-release.yaml
@@ -38,6 +38,9 @@ jobs:
   build-release:
     name: Calls build-images-base workflow
     needs: set-vars
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/build-images-base.yaml
     secrets: inherit
     with:
diff --git a/.github/workflows/build-images-main.yaml b/.github/workflows/build-images-main.yaml
index 8318c58c..9d3a79d7 100644
--- a/.github/workflows/build-images-main.yaml
+++ b/.github/workflows/build-images-main.yaml
@@ -9,6 +9,9 @@ on:
 jobs:
   build-main:
     name: Calls build-images-base workflow
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/build-images-base.yaml
     secrets: inherit
     with:
diff --git a/.github/workflows/build-images-nightly.yaml b/.github/workflows/build-images-nightly.yaml
index 22d4abb5..87d96b42 100644
--- a/.github/workflows/build-images-nightly.yaml
+++ b/.github/workflows/build-images-nightly.yaml
@@ -31,6 +31,9 @@ jobs:
   build-nightly:
     needs: [release-date, authorino-latest-digest]
     name: Calls build-images-base workflow
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/build-images-base.yaml
     secrets: inherit
     with: