From bb9dac4f75c769eb4c0385b2ee74167fb020070a Mon Sep 17 00:00:00 2001
From: Jakob Borg <jakob@kastelo.net>
Date: Tue, 26 May 2026 13:17:39 +0200
Subject: [PATCH] build: sign docker images

Signed-off-by: Jakob Borg <jakob@kastelo.net>
---
 .github/workflows/build-infra-dockers.yaml | 14 ++++++++++++--
 .github/workflows/build-syncthing.yaml     | 18 ++++++++++++++++++
 2 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-infra-dockers.yaml b/.github/workflows/build-infra-dockers.yaml
index 85284a1a1..a5b538d7a 100644
--- a/.github/workflows/build-infra-dockers.yaml
+++ b/.github/workflows/build-infra-dockers.yaml
@@ -15,6 +15,7 @@ env:
 permissions:
   contents: read
   packages: write
+  id-token: write
 
 jobs:
   docker-syncthing:
@@ -30,11 +31,11 @@ jobs:
           - stupgrades
           - ursrv
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # was: actions/checkout@v5
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # was: actions/setup-go@v6
         with:
           go-version: ${{ env.GO_VERSION }}
           check-latest: true
@@ -77,6 +78,7 @@ jobs:
           echo "TAGS=$tags" >> $GITHUB_ENV
 
       - name: Build and push
+        id: build
         uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           context: .
@@ -86,3 +88,11 @@ jobs:
           tags: ${{ env.TAGS }}
           labels: |
             org.opencontainers.image.revision=${{ github.sha }}
+
+      - name: Install Cosign
+        if: github.ref == 'refs/heads/infrastructure'
+        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
+
+      - name: Sign image
+        if: github.ref == 'refs/heads/infrastructure'
+        run: cosign sign --yes --recursive ghcr.io/syncthing/infra/${{ matrix.pkg }}:latest@${{ steps.build.outputs.digest }}
\ No newline at end of file
diff --git a/.github/workflows/build-syncthing.yaml b/.github/workflows/build-syncthing.yaml
index 1cc4ba6a3..286b7b339 100644
--- a/.github/workflows/build-syncthing.yaml
+++ b/.github/workflows/build-syncthing.yaml
@@ -1012,6 +1012,7 @@ jobs:
     permissions:
       contents: read
       packages: write
+      id-token: write
     needs:
       - facts
     env:
@@ -1115,6 +1116,7 @@ jobs:
           mv bin/* script ctx
 
       - name: Build and push Docker image
+        id: build
         uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: ctx
@@ -1126,6 +1128,22 @@ jobs:
             org.opencontainers.image.version=${{ env.VERSION }}
             org.opencontainers.image.revision=${{ github.sha }}
 
+      - name: Install Cosign
+        if: github.event_name == 'push'
+        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
+
+      - name: Sign image
+        if: github.event_name == 'push'
+        env:
+          DIGEST: ${{ steps.build.outputs.digest }}
+        run: |
+          IFS="," read -ra tags <<< $DOCKER_TAGS
+          images=""
+          for tag in ${tags[@]}; do
+            images+="${tag}@${DIGEST} "
+          done
+          cosign sign --yes --recursive ${images}
+
   #
   # Sync images to Docker hub. This takes the images already pushed to GHCR
   # and copies them to Docker hub. Runs for releases only.