From efda20607844a66f665fa32fe986b4726e851efb Mon Sep 17 00:00:00 2001
From: pos <pgousdal@users.noreply.github.com>
Date: Sat, 5 Sep 2026 23:01:57 +0200
Subject: [PATCH] M11.4: sign release digest with Cosign OIDC

---
 .github/workflows/release.yml | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b16242d..3017837 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -110,3 +110,26 @@ jobs:
           subject-name: ${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.push.outputs.digest }}
           push-to-registry: true
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62
+
+      - name: Sign exact release digest with GitHub OIDC
+        env:
+          IMAGE_DIGEST: ${{ steps.push.outputs.digest }}
+        run: |
+          set -eu
+          test -n "$IMAGE_DIGEST"
+          cosign sign --yes "${IMAGE_NAME}@${IMAGE_DIGEST}"
+
+      - name: Verify keyless release signature
+        env:
+          IMAGE_DIGEST: ${{ steps.push.outputs.digest }}
+        run: |
+          set -eu
+          test -n "$IMAGE_DIGEST"
+          cosign verify \
+            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+            --certificate-identity-regexp '^https://github.com/Ploos-AS/soju/.github/workflows/release.yml@refs/tags/v.*$' \
+            "${IMAGE_NAME}@${IMAGE_DIGEST}" > /tmp/cosign-verification.json
+          test -s /tmp/cosign-verification.json