Bump sigstore/cosign-installer from 3.2.0 to 3.3.0 #36

	name: Build and publish Docker images

	on:
	push:
	branches:
	- main
	workflow_dispatch:

	permissions:
	contents: read
	packages: write

	env:
	IMAGE_NAME: ldap

	jobs:
	build:
	runs-on: ubuntu-20.04
	steps:
	- uses: actions/checkout@v4
	- name: Get lowercase base image name
	run: echo BASE_IMAGE_NAME="$(echo ${{ github.repository_owner }} \| tr '[A-Z]' '[a-z]')" >> $GITHUB_ENV
	- name: Build image
	run: docker build -t ghcr.io/${{ env.BASE_IMAGE_NAME }}/${{ env.IMAGE_NAME }} --label revision=${{ github.sha }} --label workflow_run_id=${{ github.run_id }} .
	- name: Install Cosign
	uses: sigstore/[email protected]
	- name: Log into ghcr.io
	run: echo "${{ secrets.GITHUB_TOKEN }}" \| docker login ghcr.io -u ${{ github.actor }} --password-stdin
	- name: Publish image
	run: docker push ghcr.io/${{ env.BASE_IMAGE_NAME }}/${{ env.IMAGE_NAME }}
	- name: Sign image
	env:
	VAULT_ADDR: ${{ secrets.VAULT_ADDR }}
	run: \|
	export VAULT_TOKEN=$(curl "$VAULT_ADDR"/v1/auth/approle/login --silent --fail -X POST --data '{"role_id": "${{ secrets.VAULT_ROLE_ID_SIGNING }}", "secret_id": "${{ secrets.VAULT_SECRET_ID_SIGNING }}"}' \| jq -r '.auth.client_token')
	cosign sign --yes --tlog-upload=true --key hashivault://tuleap-additional-tools-signing "$(docker inspect --format='{{index .RepoDigests 0}}' ghcr.io/${{ env.BASE_IMAGE_NAME }}/${{ env.IMAGE_NAME }})"

Provide feedback