I feel like this shoulda worked.

Why doesn't Cosign have the right creds? Idk...

.github/workflows/build.yaml

@@ -75,7 +75,7 @@ jobs:
           IMAGE: ${{ steps.build_image.outputs.image }}
           TAGS: ${{ steps.build_image.outputs.tags }}
           DIGEST: ${{ steps.push.outputs.digest }}
-          SIGSTORE_ID_TOKEN: 
+          # SIGSTORE_ID_TOKEN: ${{ GITHUB_TOKEN }}
         # This step uses the identity token to provision an ephemeral certificate
         # against the sigstore community Fulcio instance.
         run: echo "${TAGS}" | xargs -I {} cosign sign --yes ${IMAGE}:{}@${DIGEST}