Merge pull request #6 from nijogeorgep/nijogeorgep-patch-2

Update docker-publish.yml

Author: nijogeorgep

.github/workflows/docker-publish.yml

@@ -41,14 +41,6 @@ jobs:
  java-version: 1.11
  - name: Build with Maven
  run: mvn -B package --file pom.xml
- # Install the cosign tool except on PR
- # https://github.com/sigstore/cosign-installer
- - name: Install cosign
- if: github.event_name != 'pull_request'
- uses: sigstore/cosign-installer@d6a3abf1bdea83574e28d40543793018b6035605
- with:
- cosign-release: 'v1.7.1'
-
 
  # Workaround: https://github.com/docker/build-push-action/issues/461
  - name: Setup Docker buildx
@@ -71,6 +63,7 @@ jobs:
  uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
  with:
  images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+ tags: type=raw,value={{sha}}
 
  # Build and push Docker image with Buildx (don't push on PR)
  # https://github.com/docker/build-push-action
@@ -82,16 +75,3 @@ jobs:
  push: ${{ github.event_name != 'pull_request' }}
  tags: ${{ steps.meta.outputs.tags }}
  labels: ${{ steps.meta.outputs.labels }}
-
- # Sign the resulting Docker image digest except on PRs.
- # This will only write to the public Rekor transparency log when the Docker
- # repository is public to avoid leaking data. If you would like to publish
- # transparency data even for private images, pass --force to cosign below.
- # https://github.com/sigstore/cosign
- - name: Sign the published Docker image
- if: ${{ github.event_name != 'pull_request' }}
- env:
- COSIGN_EXPERIMENTAL: "true"
- # This step uses the identity token to provision an ephemeral certificate
- # against the sigstore community Fulcio instance.
- run: cosign sign ${{ steps.meta.outputs.tags }}@${{ steps.build-and-push.outputs.digest }}