pezkuwichain 2cbfd21539 fix(cosign): explicit GHCR login before sign + verify ...

docker/login-action writes ~/.docker/config.json but cosign on self-
hosted runner does not always read it. Add 'cosign login ghcr.io'
before sign (build-image) and verify (deploy-app, deploy-pex) so the
registry blob upload/download authenticates correctly.

The previous run signed via Sigstore (Fulcio cert + Rekor tlog entry
created) but failed at the final 'push signature blob to GHCR' step
with UNAUTHORIZED. Explicit cosign login solves this.

2026-05-09 13:41:29 +03:00

..

codeql.yml

ci(security): Faz 3 + ekstra — runner consolidation, auto-rollback, cosign, SRI, dep cleanup

2026-05-09 12:08:49 +03:00

quality-gate.yml

fix(cosign): explicit GHCR login before sign + verify

2026-05-09 13:41:29 +03:00