Fix docker image validation in CI (#667)

veracruz-project · Nov 28, 2023 · cc7c645 · cc7c645
2 parents 28a2464 + ca33e3e
commit cc7c645
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -20,13 +20,15 @@ jobs:
     steps:
       - name: Install cosign
         # https://github.com/sigstore/cosign-installer
-        uses: sigstore/cosign-installer@9becc617647dfa20ae7b1151972e9b3a2c338a2b # v2.8.1
+        uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8 # v3.2.0
         with:
-          cosign-release: "v1.13.1"
+          cosign-release: "v2.2.1"
       - name: Check image signature
         id: cosign-verify
         run: |
             COSIGN_EXPERIMENTAL=true cosign verify \
+            --certificate-identity-regexp 'https://github.com/veracruz-project/veracruz/.github/workflows/docker.yml@refs/heads/main' \
+            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
               ghcr.io/veracruz-project/veracruz/ci@sha256:dd434df33153bd8915859eb0f280270d2cdf07d6100ef4332bcd18c5e8525068
 
   linux: