name: Cosign keyless OIDC release signing

on:
  release:
    types: [published]
  push:
    tags:
      - 'v*'

permissions:
  contents: read
  packages: write
  id-token: write  # Required for OIDC keyless signing

jobs:
  sign:
    name: Sign container image (keyless OIDC)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Log in to GHCR
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Sign container image (keyless)
        env:
          COSIGN_EXPERIMENTAL: "1"
        run: |
          IMAGE="ghcr.io/${{ github.repository }}:${{ github.ref_name }}"
          echo "Signing ${IMAGE}"
          cosign sign --yes "${IMAGE}"

      - name: Verify signature
        env:
          COSIGN_EXPERIMENTAL: "1"
        run: |
          IMAGE="ghcr.io/${{ github.repository }}:${{ github.ref_name }}"
          cosign verify \
            --certificate-identity-regexp="https://github.com/${{ github.repository }}" \
            --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
            "${IMAGE}"