Looping container image signing

ossf · Dec 19, 2024 · cdbf22a · cdbf22a
1 parent 13447b7
commit cdbf22a
Showing 1 changed file with 8 additions and 4 deletions.
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -37,10 +37,14 @@ jobs:
           KO_DEFAULTBASEIMAGE: cgr.dev/chainguard/busybox
           KO_DEFAULTPLATFORMS: linux/arm64,linux/amd64
       - run: |
-          echo "signing $(cat allstar.ref)"
-          cosign sign --yes -a git_sha="$GITHUB_SHA" "$(cat allstar.ref)"
-          echo "signing $(cat allstar-busybox.ref)"
-          cosign sign --yes -a git_sha="$GITHUB_SHA" "$(cat allstar-busybox.ref)"
+          while read ref; do
+            echo "signing $ref"
+            cosign sign --yes -a git_sha="$GITHUB_SHA" "$ref"
+          done < allstar.ref
+          while read ref; do
+            echo "signing $ref"
+            cosign sign --yes -a git_sha="$GITHUB_SHA" "$ref"
+          done < allstar-busybox.ref
 
       - run: |
           gh release create ${{ github.ref_name }} --notes "Images: