.github/actions/sign/action.yml (2)

69-87: ⚠️ Potential issue | 🔴 Critical

cosign verify-attestation missing --certificate-identity and --certificate-oidc-issuer in cosign v3.x.

Starting with cosign v2.0, cosign verify-attestation requires explicit certificate identity and OIDC issuer flags for keyless verification (the COSIGN_EXPERIMENTAL env var no longer enables implicit trust). The calls on lines 81, 87, and 111 will fail without these flags.

The helm workflow already demonstrates the correct pattern on lines 161-163.

Proposed fix for verify-attestation commands

Line 81:

-        cosign verify-attestation --type spdx ${IMAGE_NAME}@${CONTAINER_DIGEST} | jq '.payload |= `@base64d` | .payload | fromjson'
+        cosign verify-attestation --type spdx ${IMAGE_NAME}@${CONTAINER_DIGEST} \
+            --certificate-identity-regexp "https://github.com/$GITHUB_REPOSITORY/*" \
+            --certificate-oidc-issuer https://token.actions.githubusercontent.com | jq '.payload |= `@base64d` | .payload | fromjson'

Line 87:

-        cosign verify-attestation --type spdx ${IMAGE_NAME}@${CONTAINER_DIGEST} | jq '.payload |= `@base64d` | .payload | fromjson'
+        cosign verify-attestation --type spdx ${IMAGE_NAME}@${CONTAINER_DIGEST} \
+            --certificate-identity-regexp "https://github.com/$GITHUB_REPOSITORY/*" \
+            --certificate-oidc-issuer https://token.actions.githubusercontent.com | jq '.payload |= `@base64d` | .payload | fromjson'

Line 111:

-        cosign verify-attestation --type slsaprovenance ${IMAGE_NAME}@${CONTAINER_DIGEST}
+        cosign verify-attestation --type slsaprovenance ${IMAGE_NAME}@${CONTAINER_DIGEST} \
+            --certificate-identity-regexp "https://github.com/$GITHUB_REPOSITORY/*" \
+            --certificate-oidc-issuer https://token.actions.githubusercontent.com

---

60-67: ⚠️ Potential issue | 🔴 Critical

Add --yes flag to all cosign commands and remove obsolete COSIGN_EXPERIMENTAL — cosign v2.0+ requires this for non-interactive CI/CD.

With cosign v2.0+, non-interactive signing requires the --yes flag to skip confirmation prompts. Without it, these commands will hang in CI. The COSIGN_EXPERIMENTAL environment variable is also obsolete since v2.0—keyless signing is the default behavior now.

Apply --yes to lines 67, 80, 86, and 110, and remove COSIGN_EXPERIMENTAL from lines 63, 73, 97, and 104. The helm workflow (line 160) already uses this pattern correctly.

Proposed fixes

Line 67:

-      run: cosign sign -a GITHUB_ACTOR=${GITHUB_TRIGGERING_ACTOR} "${IMAGE_NAME}@${CONTAINER_DIGEST}"
+      run: cosign sign --yes -a GITHUB_ACTOR=${GITHUB_TRIGGERING_ACTOR} "${IMAGE_NAME}@${CONTAINER_DIGEST}"

Line 80:

-        cosign attest --predicate sbom.${IMAGE_TAG}.spdx.json --type spdx "${IMAGE_NAME}@${CONTAINER_DIGEST}"
+        cosign attest --yes --predicate sbom.${IMAGE_TAG}.spdx.json --type spdx "${IMAGE_NAME}@${CONTAINER_DIGEST}"

Line 86:

-        cosign attest --predicate sbom.gomod.${IMAGE_TAG}.spdx.json --type spdx "${IMAGE_NAME}@${CONTAINER_DIGEST}"
+        cosign attest --yes --predicate sbom.gomod.${IMAGE_TAG}.spdx.json --type spdx "${IMAGE_NAME}@${CONTAINER_DIGEST}"

Line 110:

-        cosign attest --predicate provenance-predicate.att --type slsaprovenance "${IMAGE_NAME}@${CONTAINER_DIGEST}"
+        cosign attest --yes --predicate provenance-predicate.att --type slsaprovenance "${IMAGE_NAME}@${CONTAINER_DIGEST}"

Remove COSIGN_EXPERIMENTAL: "1" from env blocks on lines 63, 73, and 104 (line 97 already uses COSIGN_EXPERIMENTAL: "0").