clean up & also add to tag workflow

.github/workflows/push.yml

@@ -68,8 +68,8 @@ jobs:
           cosign sign --yes --key env://COSIGN_PRIVATE_KEY ${images}
         env:
           TAGS: ${{ steps.docker_meta_img.outputs.tags }}
-          COSIGN_PRIVATE_KEY: ${{ secrets.BC_3751_COSIGN_PRIVATE_KEY }}
-          COSIGN_PASSWORD: ${{ secrets.BC_3751_COSIGN_PRIVATE_KEY_PASSWORD }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PRIVATE_KEY_PASSWORD }}
           DIGEST: ${{ steps.build_and_push.outputs.digest }}
 
       - name: Sign the images with GitHub OIDC Token

.github/workflows/tag.yml

@@ -14,23 +14,16 @@ jobs:
       packages: write
     steps:
       - uses: actions/checkout@v4
-      - name: Docker meta Service Name
-        id: docker_meta_img
-        uses: docker/metadata-action@v5
-        with:
-          images: ghcr.io/${{ github.repository }}
-          tags: |
-            type=ref,event=branch,enable=false,priority=600
-            type=sha,enable=true,priority=600,prefix=
 
       - name: Docker meta Service Name for docker hub
-        id: docker_meta_img_hub
+        id: docker_meta_img
         uses: docker/metadata-action@v5
         with:
           images: docker.io/schulcloud/superhero-dashboard, quay.io/schulcloudverbund/superhero-dashboard
           tags: |
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
+            type=sha,format=long
 
       - name: Log into docker registry
         uses: docker/login-action@v3
@@ -46,6 +39,7 @@ jobs:
           password: ${{ secrets.QUAY_TOKEN }}
 
       - name: Build and push ${{ github.repository }}
+        id: build_and_push
         uses: docker/build-push-action@v5
         with:
           context: .
@@ -55,3 +49,31 @@ jobs:
           pull: true
           tags: ${{ steps.docker_meta_img_hub.outputs.tags }}
           labels: ${{ steps.docker_meta_img_hub.outputs.labels }}
+
+
+      - name: Install Cosign
+        uses: sigstore/[email protected]
+
+      - name: Sign image with a key
+        run: |
+          images=""
+          for tag in ${TAGS}; do
+            images+="${tag}@${DIGEST} "
+          done
+          cosign sign --yes --key env://COSIGN_PRIVATE_KEY ${images}
+        env:
+          TAGS: ${{ steps.docker_meta_img.outputs.tags }}
+          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
+          COSIGN_PASSWORD: ${{ secrets.COSIGN_PRIVATE_KEY_PASSWORD }}
+          DIGEST: ${{ steps.build_and_push.outputs.digest }}
+
+      - name: Sign the images with GitHub OIDC Token
+        env:
+          DIGEST: ${{ steps.build_and_push.outputs.digest }}
+          TAGS: ${{ steps.docker_meta_img.outputs.tags }}
+        run: |
+          images=""
+          for tag in ${TAGS}; do
+            images+="${tag}@${DIGEST} "
+          done
+          cosign sign --yes ${images}