Add cosign tool

zenjoy · Jul 4, 2024 · 2fbd69b · 2fbd69b
1 parent c60ada5
commit 2fbd69b
Showing 1 changed file with 8 additions and 3 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -74,9 +74,6 @@ jobs:
           labels: |
             org.opencontainers.image.title=ruby
 
-      - name: Install Cosign
-        uses: sigstore/[email protected]
-
       - name: Login to Docker Hub
         uses: docker/login-action@v3
         with:
@@ -135,10 +132,18 @@ jobs:
     needs:
       - build
 
+    permissions:
+      id-token: write # keyless Cosign signatures
+      packages: write # GHCR
+      contents: write # git tags
+
     steps:
       - name: Checkout repo
         uses: actions/checkout@v4
 
+      - name: Install Cosign
+        uses: sigstore/[email protected]
+
       - name: Download digests
         uses: actions/download-artifact@v4
         with: