Build, Push & Sign Docker Image #12

	name: Build, Push & Sign Docker Image

	on:
	workflow_dispatch:

	env:
	IMAGE: ${{secrets.DOCKER_USER}}/ubuntu-patched
	TAG: 1.0.5

	jobs:
	image-lifecycle:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- name: Setup Docker
	uses: docker/setup-buildx-action@v3
	- name: Setup Cosign
	run: \|
	curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64"
	sudo mv cosign-linux-amd64 /usr/local/bin/cosign
	sudo chmod +x /usr/local/bin/cosign
	cosign version
	- name: Login to Docker
	run: echo ${{secrets.DOCKER_TOKEN}} \| docker login -u ${{secrets.DOCKER_USER}} --password-stdin
	- name: Build and Push docker image
	uses: docker/build-push-action@v5
	id: build-and-push
	with:
	file: ./Dockerfile
	push: true
	provenance: false
	tags: ${{ env.IMAGE }}:${{ env.TAG }}
	- name: Sign container image with a key
	uses: dodopizza/[email protected]
	with:
	image-tags: ${{ env.IMAGE }}:${{ env.TAG }}
	image-digest: ${{ steps.build-and-push.outputs.digest }}
	cosign-private-key: ${{ secrets.COSIGN_KEY }}
	cosign-password: ${{ secrets.COSIGN_PASSWORD }}
	- name: Verify image signature
	run: \|
	apt install jq -y
	cosign verify --key cosign.pub ${{env.IMAGE}} \| jq .

Provide feedback