diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml index fc0704b..1726237 100644 --- a/.github/workflows/publish-image.yml +++ b/.github/workflows/publish-image.yml @@ -211,6 +211,9 @@ jobs: IMAGE_NAME: ${{ needs.build.outputs.image }} IMAGE_DIGEST: ${{ needs.build.outputs.digest }} run: | - cosign version - COSIGN_EXPERIMENTAL=1 cosign verify-attestation --certificate-identity-regexp=".*" --certificate-oidc-issuer-regexp=".*" --type slsaprovenance "${{ env.IMAGE_NAME }}@${{env.IMAGE_DIGEST}}" + cosign version \ + COSIGN_EXPERIMENTAL=1 cosign verify-attestation \ + --certificate-identity-regexp=".*" \ + --certificate-oidc-issuer-regexp=".*" \ + --type slsaprovenance "${{ env.IMAGE_NAME }}@${{env.IMAGE_DIGEST}}" # TODO(github.com/slsa-framework/slsa-verifier/issues/92): Add step to verify using slsa-verifier