fix docker cosign action (#38)

.github/workflows/docker.yml

@@ -6,9 +6,10 @@ on:
       - "v1.*"
     branches:
       - "main"
+  workflow_dispatch:
 
 jobs:
-  docker:
+  docker-build:
     name: Docker Image
     runs-on: ubuntu-latest
     permissions:
@@ -38,9 +39,6 @@ jobs:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
 
-    - name: Install Cosign
-      uses: sigstore/cosign-installer@v3
-
     - name: Build and push multi-arch images to GHCR
       run: |
         go run build/ci.go dockerx -platform linux/amd64,linux/arm64 -hub ghcr.io/berachain/bera-geth -upload
@@ -50,26 +48,47 @@ jobs:
       run: |
         # Extract version information
         if [[ "${{ github.ref }}" == refs/tags/* ]]; then
-          VERSION="${{ github.ref_name }}"
+          echo "VERSION=${{ github.ref_name }}" >> $GITHUB_OUTPUT
         elif [[ "${{ github.ref }}" == refs/heads/main ]]; then
-          VERSION="latest"
+          echo "VERSION=latest" >> $GITHUB_OUTPUT
         else
-          VERSION="branch-${GITHUB_REF##*/}"
+          echo "VERSION=" >> $GITHUB_OUTPUT
         fi
         
         # Get the digest of the pushed image. The --format option can be unreliable,
         # so we parse the full JSON output to find the digest of the manifest list.
         MANIFEST_JSON=$(docker buildx imagetools inspect ghcr.io/berachain/bera-geth:${VERSION})
-        DIGEST=$(echo "${MANIFEST_JSON}" | grep '"digest"' | head -n 1 | cut -d '"' -f 4)
+        echo "DIGEST=$(echo "${MANIFEST_JSON}" | grep '"digest"' | head -n 1 | cut -d '"' -f 4)" >> $GITHUB_OUTPUT
-        echo "digest=${DIGEST}" >> $GITHUB_OUTPUT
+    outputs:
-        echo "version=${VERSION}" >> $GITHUB_OUTPUT
+      VERSION: ${{ steps.image_info.outputs.VERSION }}
+      DIGEST: ${{ steps.image_info.outputs.DIGEST }}
+
+  docker-signatures:
+    name: Docker Signatures
+    needs: [docker-build]
+    runs-on: ubuntu-latest
+    env:
+      VERSION: ${{ needs.docker-build.outputs.VERSION }}
+      DIGEST: ${{ needs.docker-build.outputs.DIGEST }}
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Install Cosign
+      uses: sigstore/cosign-installer@v3
 
     - name: Sign Docker images with Cosign
       env:
         COSIGN_EXPERIMENTAL: true
       run: |
-        # Sign the multi-arch manifest by digest
+        # Sign the tagged version if it exists
-        cosign sign --yes ghcr.io/berachain/bera-geth@${{ steps.image_info.outputs.digest }}
+        if [ -n "${{ env.VERSION }}" ]; then
+          cosign sign --yes ghcr.io/berachain/bera-geth:${{ env.VERSION }}
+        fi
         
-        # Also sign the tagged version
+        # Sign the multi-arch manifest by digest
-        cosign sign --yes ghcr.io/berachain/bera-geth:${{ steps.image_info.outputs.version }}
+        cosign sign --yes ghcr.io/berachain/bera-geth@${{ env.DIGEST }}

.github/workflows/release.yml

@@ -4,6 +4,7 @@ on:
   push:
     tags:
       - "v1.*"
+  workflow_dispatch:
 
 jobs:
   extract-version:

build/ci.go

@@ -684,13 +684,12 @@ func doDockerBuildx(cmdline []string) {
 	//  - ethereum/client-go:alltools-latest                   - Pushes to the main branch, Geth & tools
 	//  - ethereum/client-go:v<major>.<minor>.<patch>          - Version tag publish on GitHub, Geth only
 	//  - ethereum/client-go:alltools-v<major>.<minor>.<patch> - Version tag publish on GitHub, Geth & tools
-	var tags []string
+	var tag string
-
 	switch {
 	case env.Branch == "main":
-		tags = []string{"latest"}
+		tag = "latest"
 	case strings.HasPrefix(env.Tag, "v1."):
-		tags = []string{env.Tag}
+		tag = env.Tag
 	}
 	// Need to create a mult-arch builder
 	check := exec.Command("docker", "buildx", "inspect", "multi-arch-builder")
@@ -705,7 +704,6 @@ func doDockerBuildx(cmdline []string) {
 		{file: "Dockerfile", base: fmt.Sprintf("%s:", *hubImage)},
 		{file: "Dockerfile.alltools", base: fmt.Sprintf("%s:alltools-", *hubImage)},
 	} {
-		for _, tag := range tags { // latest, stable etc
 		gethImage := fmt.Sprintf("%s%s", spec.base, tag)
 		cmd := exec.Command("docker", "buildx", "build",
 			"--build-arg", "COMMIT="+env.Commit,
@@ -722,7 +720,6 @@ func doDockerBuildx(cmdline []string) {
 		build.MustRun(cmd)
 	}
 }
-}
 
 // Debian Packaging
 func doDebianSource(cmdline []string) {