🌱 Signing scorecard images using cosign

Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>
ossf · May 29, 2022 · 93da787 · 93da787
1 parent a60ac06
commit 93da787
Showing 1 changed file with 7 additions and 3 deletions.
diff --git a/.github/workflows/publishimage.yml b/.github/workflows/publishimage.yml
@@ -20,9 +20,13 @@ permissions:
   packages: write
 
 on:
+  pull_request:
+    branches:
+      - main
   push:
     branches:
       - main
+  worflow_dispatch:
 env:
   GO_VERSION: 1.17.7
 
@@ -59,7 +63,7 @@ jobs:
             make install
             make scorecard-ko
      - name: Install Cosign
-       uses: sigstore/cosign-installer@f700e6fbbab82f6897758a3af7a8dede4e308656 # v1.2.1
+       uses: sigstore/cosign-installer@f700e6fbbab82f6897758a3af7a8dede4e308656
      - name: Sign image
-        run: |
-          cosign sign ghcr.io/${{github.repository_owner}}/stunning-tribble:${{ github.sha }}
+       run: |
+          cosign sign ghcr.io/${{github.repository_owner}}/scorecard:${{ github.sha }}