How to Sign a Container Image With Cosign Keyless in CI

Cosign keyless signing uses the workflow OIDC identity, so there is no signing key to manage or leak.

Install cosign with sigstore/cosign-installer, grant id-token: write, then run cosign sign against the pushed image digest with COSIGN_EXPERIMENTAL keyless mode.

Steps

• Add permissions: id-token: write and packages: write.
• Install cosign with sigstore/cosign-installer.
• Run cosign sign --yes <image>@<digest> after the push.

Workflow

permissions:
  id-token: write
  packages: write
steps:
  - uses: sigstore/cosign-installer@v3
  - id: build
    uses: docker/build-push-action@v6
    with:
      context: .
      push: true
      tags: ghcr.io/${{ github.repository }}:latest
  - run: cosign sign --yes ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}

Gotchas

• Sign the digest, not a mutable tag, so the signature stays valid.
• Verify with cosign verify --certificate-identity-regexp ... --certificate-oidc-issuer https://token.actions.githubusercontent.com.

Related guides