feat: cosign and SBOM generation for all GHCR images

.github/actions/sign-image/action.yml

@@ -0,0 +1,38 @@
+name: Sign image
+description: Keyless cosign signature on a pushed image plus a syft SPDX SBOM attestation on each of its platform manifests
+inputs:
+  images:
+    description: Pushed image references, one per line
+    required: true
+  sbom:
+    description: Attach an SBOM attestation to every platform manifest
+    default: "true"
+runs:
+  using: composite
+  steps:
+    - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+    - if: inputs.sbom == 'true'
+      uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
+    - shell: bash
+      env:
+        IMAGES: ${{ inputs.images }}
+        SBOM: ${{ inputs.sbom }}
+      run: |
+        set -euo pipefail
+        identity=(--certificate-oidc-issuer https://token.actions.githubusercontent.com
+                  --certificate-identity-regexp "^https://github.com/$GITHUB_REPOSITORY/\.github/workflows/[^@]+@$GITHUB_REF\$")
+        while read -r image; do
+          [ -n "$image" ] || continue
+          repo=${image%%@*}; repo=${repo%:*}
+          manifest=$(docker buildx imagetools inspect "$image" --format '{{json .Manifest}}')
+          digest=$(jq -r .digest <<<"$manifest")
+          cosign sign --yes --recursive "$repo@$digest"
+          cosign verify "${identity[@]}" "$repo@$digest" >/dev/null
+          [ "$SBOM" = true ] || continue
+          jq -r 'if .manifests then .manifests[] | select(.platform.os != "unknown") | .digest else .digest end' <<<"$manifest" |
+          while read -r d; do
+            syft "registry:$repo@$d" -o "spdx-json=$RUNNER_TEMP/sbom.spdx.json"
+            cosign attest --yes --type spdxjson --predicate "$RUNNER_TEMP/sbom.spdx.json" "$repo@$d"
+            cosign verify-attestation --type spdxjson "${identity[@]}" "$repo@$d" >/dev/null
+          done
+        done <<<"$IMAGES"

.github/workflows/pre-release-fips.yaml

@@ -3,6 +3,10 @@ on:
     tags:
       - "v*" # Push events to matching v*, i.e. v1.0, v20.15.10
 name: Create prerelease FIPS images
+permissions:
+  contents: read
+  packages: write
+  id-token: write
 env:
   REGISTRY: ghcr.io/hatchet-dev/hatchet
 jobs:
@@ -50,6 +54,9 @@ jobs:
             .
       - name: Push to GHCR
         run: docker push $REGISTRY/hatchet-${{ matrix.target }}-fips:${{ steps.tag_name.outputs.tag }}-${{ matrix.arch }}
+      - uses: ./.github/actions/sign-image
+        with:
+          images: ${{ env.REGISTRY }}/hatchet-${{ matrix.target }}-fips:${{ steps.tag_name.outputs.tag }}-${{ matrix.arch }}
 
   frontend:
     name: hatchet-frontend-fips-${{ matrix.arch }}
@@ -88,6 +95,9 @@ jobs:
             .
       - name: Push to GHCR
         run: docker push $REGISTRY/hatchet-frontend-fips:${{ steps.tag_name.outputs.tag }}-${{ matrix.arch }}
+      - uses: ./.github/actions/sign-image
+        with:
+          images: ${{ env.REGISTRY }}/hatchet-frontend-fips:${{ steps.tag_name.outputs.tag }}-${{ matrix.arch }}
 
   lite:
     name: hatchet-lite-fips-${{ matrix.arch }}
@@ -140,6 +150,9 @@ jobs:
             .
       - name: Push to GHCR
         run: docker push $REGISTRY/hatchet-lite-fips:${{ steps.tag_name.outputs.tag }}-${{ matrix.arch }}
+      - uses: ./.github/actions/sign-image
+        with:
+          images: ${{ env.REGISTRY }}/hatchet-lite-fips:${{ steps.tag_name.outputs.tag }}-${{ matrix.arch }}
 
   dashboard:
     name: hatchet-dashboard-fips-${{ matrix.arch }}
@@ -187,6 +200,9 @@ jobs:
             .
       - name: Push to GHCR
         run: docker push $REGISTRY/hatchet-dashboard-fips:${{ steps.tag_name.outputs.tag }}-${{ matrix.arch }}
+      - uses: ./.github/actions/sign-image
+        with:
+          images: ${{ env.REGISTRY }}/hatchet-dashboard-fips:${{ steps.tag_name.outputs.tag }}-${{ matrix.arch }}
 
   fips-enabled:
     name: Verify fips images link the validated module
@@ -235,6 +251,8 @@ jobs:
         run: echo "tag=${GITHUB_TAG/refs\/tags\//}" >> $GITHUB_OUTPUT
         env:
           GITHUB_TAG: ${{ github.ref }}
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Login to GHCR
         run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
       - name: Combine
@@ -245,3 +263,7 @@ jobs:
           docker pull $img:$tag-arm64
           docker manifest create $img:$tag $img:$tag-amd64 $img:$tag-arm64
           docker manifest push $img:$tag
+      - uses: ./.github/actions/sign-image
+        with:
+          images: ${{ env.REGISTRY }}/hatchet-${{ matrix.image }}-fips:${{ steps.tag_name.outputs.tag }}
+          sbom: false