Fix GH Actions issue: run and uses are mutually exclusive

mostafa · Aug 12, 2022 · e3615e0 · e3615e0
1 parent a7e5b37
commit e3615e0
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
@@ -65,6 +65,10 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
+      - name: Install cosign ⬇️
+        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
+        uses: sigstore/cosign-installer@main
+
       - name: Copy the cosign keys 📋
         if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
         run: |
@@ -77,14 +81,12 @@ jobs:
 
       - name: Sign the Docker image ✍️
         if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
-        uses: sigstore/cosign-installer@main
         run: cosign sign --key cosign.key mostafamoradian/xk6-kafka:${{ steps.meta.outputs.tags }}
         env:
           COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
 
       - name: Verify the Docker image signature ✅
         if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
-        uses: sigstore/cosign-installer@main
         run: cosign verify --key cosign.pub mostafamoradian/xk6-kafka:${{ steps.meta.outputs.tags }}
 
       - name: Remove the cosign keys 🧹