Keyless image signing with cosign in GitHub Actions
A long-lived signing key is one more secret to leak. With keyless signing, the job uses its GitHub OIDC token (permissions: id-token: write) to get a short-lived Sigstore certificate. Sign the image by digest, not tag.
Then verify who signed it (your workflow's identity) and the issuer (token.actions.githubusercontent.com). Maps to OWASP CICD-SEC-9, Improper Artifact Integrity Validation.
Job excerpt (fictional acme-lab, placeholder values, .github/workflows/release.yml):
permissions:
contents: read
packages: write
id-token: write
steps:
- uses: sigstore/cosign-installer@v4.1.2
# ...log in, build and push (id: build)
- run: cosign sign --yes "$IMAGE@$DIGEST"
env:
IMAGE: ghcr.io/acme-lab/app
DIGEST: ${{ steps.build.outputs.digest }}
Verify before deploy:
cosign verify \
--certificate-identity-regexp '^github\.com/acme-lab/app/\.github/workflows/' \
--certificate-oidc-issuer token.actions.githubusercontent.com \
ghcr.io/acme-lab/app@sha256:YOUR_DIGEST
Notes:
- To lock it to one workflow and branch, use --certificate-identity github.com/acme-lab/app/.github/workflows/release…
- cosign-installer has no floating @v4 tag, so pin a full release (v4.1.2 is the latest as of 20 Oct 2026) or a commit SHA. It installs cosign v3.0.6 by default; set cosign-release to pin a newer cosign.
- --yes skips cosign's confirmation prompt (Sigstore docs: it agrees to Sigstore's terms of use), which suits non-interactive CI.
- Signing events are recorded in Sigstore's public Rekor transparency log, and the certificate identity includes the repo and workflow path. Bear that in mind for private repos.
Sources:
OWASP CICD-SEC-9: owasp.org
Sigstore, keyless signing overview: docs.sigstore.dev
Sigstore CI quickstart: docs.sigstore.dev
Sigstore verification cheat sheet: docs.sigstore.dev
sigstore/cosign-installer: sigstore/cosign-installer
GitHub Docs, OIDC reference (id-token: write): docs.github.com
Related: OWASP Top 10 CI/CD risks youtube.com
Narration uses an AI-generated voice. Fictional acme-lab demo; defensive education only.
#Shorts #GitHubActions #Sigstore #DevSecOps #SupplyChainSecurity
1 like · 1 comment · 46 views
Mentions
Keyless image signing with cosign in GitHub Actions A long-lived signing key is one more secret to leak. With keyless signing, the job uses its GitHub OIDC token (permissions: id-token: write) to get a short-lived Sigstore certificate. Sign the image by digest, not tag. Then verify who signed it (your workflow's identity) and the issuer (token.actions.githubusercontent.com). Maps to OWASP CICD-SEC-9, Improper Artifact Integrity Validation. Job excerpt (fictional acme-lab, placeholder values, .github/workflows/release.yml): permissions: contents: read packages: write id-token: write steps: - uses: sigstore/cosign-installer@v4.1.2 # ...log in, build and push (id: build) - run: cosign sign --yes "$IMAGE@$DIGEST" env: IMAGE: ghcr.io/acme-lab/app DIGEST: ${{ steps.build.outputs.digest }} Verify before deploy: cosign verify \ --certificate-identity-regexp '^github\.com/acme-lab/app/\.github/workflows/' \ --certificate-oidc-issuer token.actions.githubusercontent.com \ ghcr.io/acme-lab/app@sha256:YOUR_DIGEST Notes: - To lock it to one workflow and branch, use --certificate-identity github.com/acme-lab/app/.github/workflows/release… - cosign-installer has no floating @v4 tag, so pin a full release (v4.1.2 is the latest as of 20 Oct 2026) or a commit SHA. It installs cosign v3.0.6 by default; set cosign-release to pin a newer cosign. - --yes skips cosign's confirmation prompt (Sigstore docs: it agrees to Sigstore's terms of use), which suits non-interactive CI. - Signing events are recorded in Sigstore's public Rekor transparency log, and the certificate identity includes the repo and workflow path. Bear that in mind for private repos. Sources: OWASP CICD-SEC-9: owasp.org Sigstore, keyless signing overview: docs.sigstore.dev Sigstore CI quickstart: docs.sigstore.dev Sigstore verification cheat sheet: docs.sigstore.dev sigstore/cosign-installer: sigstore/cosign-installer GitHub Docs, OIDC reference (id-token: write): docs.github.com Related: OWASP Top 10 CI/CD risks youtube.com Narration uses an AI-generated voice. Fictional acme-lab demo; defensive education only. #Shorts #GitHubActions #Sigstore #DevSecOps #SupplyChainSecurity