fix(ci): cosign digest only

[scrocquesel]

No description provided.

[agriffis]

@scrocquesel I'm curious about this PR but lacking context. Can you elaborate on what this fixes?

[scrocquesel]

Images should be signed off their digest not their tag, otherwise, the build shows

WARNING: Image reference ghcr.io/joaopfusco/bluenix:latest uses a tag, not a digest, to identify the image to sign.
    This can lead you to sign a different image than the intended one. Please use a
    digest (example.com/ubuntu@sha256:abc123...) rather than tag
    (example.com/ubuntu:latest) for the input to cosign. The ability to refer to
    images by tag will be removed in a future release.

The digest is what it is passed from the output of the push step but the step still use the output from metadata.

TBH, I was a bit lazy and the env var TAGS should be renamed to clearly show the intent.

[agriffis]

@scrocquesel This patch fails when I try to use it on my build. Any idea what I'm missing?

[scrocquesel]

The image name is with colon, are you sure you keep only the line with @

[LorbusChris]

Suggested change

	# TAGS: ${{ steps.push.outputs.digest }}
	# DIGEST: ${{ steps.push.outputs.digest }}

[LorbusChris]

Suggested change

	# cosign sign -y --key env://COSIGN_PRIVATE_KEY $IMAGE_FULL@${TAGS}
	# cosign sign -y --key env://COSIGN_PRIVATE_KEY $IMAGE_FULL@${DIGEST}

[agriffis]

The image name is with colon, are you sure you keep only the line with @

🤦‍♂️

Thank you!