Feat: CI Cosign

.github/workflows/ci-master.yml

@@ -8,6 +8,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
+    - uses: sigstore/cosign-installer@main
     - uses: actions/checkout@v2
       with:
         fetch-depth: 0
@@ -57,10 +58,12 @@ jobs:
         docker build \
         --tag docker.pkg.github.com/${GITHUB_REPOSITORY}/${ARTIFACT_ID}:${VERSION} \
         --tag ${TRUSTED_URL}/${TRUSTED_REPOSITORY}/${ARTIFACT_ID}:${VERSION} \
+        --tag ${MTR_REPOSITORY}/cwa-verification-portal:${VERSION} \
         .
       env:
         TRUSTED_URL: ${{ secrets.TRUSTED_URL }}
         TRUSTED_REPOSITORY: ${{ secrets.TRUSTED_REPOSITORY }}
+        MTR_REPOSITORY: ${{ secrets.MTR_REPOSITORY }}
     - name: docker push github
       run: |
         echo ${GITHUB_TOKEN} | docker login docker.pkg.github.com -u ${GITHUB_REPOSITORY_OWNER} --password-stdin
@@ -87,3 +90,14 @@ jobs:
         TRUSTED_REPOSITORY: ${{ secrets.TRUSTED_REPOSITORY }}
         TRUSTED_USER: ${{ secrets.TRUSTED_USER }}
         TRUSTED_TOKEN: ${{ secrets.TRUSTED_TOKEN }}
+    - name: docker push new mtr
+      run: |
+        echo ${MTR_TOKEN} | docker login ${MTR_REPOSITORY} -u ${MTR_USER} --password-stdin
+        docker push ${MTR_REPOSITORY}/cwa-verification-portal:${VERSION}
+        cosign sign --key env://MTR_PRIVATE_KEY ${MTR_REPOSITORY}/cwa-verification-portal:${VERSION}
+      env:
+        MTR_REPOSITORY: ${{ secrets.MTR_REPOSITORY }}
+        MTR_USER: ${{ secrets.MTR_USER }}
+        MTR_TOKEN: ${{ secrets.MTR_TOKEN }}
+        MTR_PRIVATE_KEY: ${{ secrets.MTR_PRIVATE_KEY }}
+        COSIGN_PASSWORD: ${{ secrets.MTR_PRIVATE_KEY_PASSWORD }}