Add artifact and image signing (#2547)

Co-authored-by: shaunak_deshmukh <shaunak@infracloud.io>

.github/workflows/release.yaml

@@ -49,12 +49,26 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@main
+        with:
+          cosign-release: 'v1.12.0'
+      - name: Check cosign install!
+        run: cosign version
+
+      - name: Write cosign signing key to disk
+        run: 'echo "$KEY" > cosign.key'
+        shell: bash
+        env:
+          KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v3
         with:
           version: latest
           args: release
         env:
+          COSIGN_PWD: ${{ secrets.COSIGN_PWD }}
           GORELEASER_CURRENT_TAG: ${{ steps.get_version.outputs.VERSION }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           DOCKER_CLI_EXPERIMENTAL: "enabled"

.gitignore

@@ -35,3 +35,5 @@ dist/
 manifest/
 .vscode/
 coverage.txt
+
+cosign.key

.goreleaser.yml

@@ -267,3 +267,29 @@ archives:
 checksum:
   name_template: "checksums.txt"
   algorithm: sha256
+
+# signs the checksum file
+# https://goreleaser.com/customization/sign
+signs:
+- cmd: cosign
+  artifacts: all
+  stdin: '{{ .Env.COSIGN_PWD }}'
+  output: true
+  args:
+    - sign-blob
+    - '--key=cosign.key'
+    - '--output-certificate=${certificate}'
+    - '--output-signature=${signature}'
+    - '${artifact}'
+
+# signs our docker image
+# https://goreleaser.com/customization/docker_sign
+docker_signs:
+- cmd: cosign
+  artifacts: all
+  stdin: '{{ .Env.COSIGN_PWD }}'
+  output: true
+  args:
+    - 'sign'
+    - '--key=cosign.key'
+    - '${artifact}'