Publish an tagged image on release (ko-build#868)

* Publish an tagged image on release

Fixes ko-build#847

Signed-off-by: Vincent Demeester <vincent@sbr.pm>

* Update some comments on the publish job

Thanks @imjasonh

Co-authored-by: Jason Hall <jason@chainguard.dev>

* Remove GITHUB_TOKEN env

No need for GITHUB_TOKEN, setup-ko handles it already.

Co-authored-by: Jason Hall <jason@chainguard.dev>

* Sign the published image with cosign

Co-authored-by: Jason Hall <jason@chainguard.dev>

Signed-off-by: Vincent Demeester <vincent@sbr.pm>
Co-authored-by: Jason Hall <jason@chainguard.dev>

.github/workflows/release.yml

@@ -35,6 +35,27 @@ jobs:
           checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
           echo "::set-output name=hashes::$(cat $checksum_file | base64 -w0)"
 
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - run: git fetch --prune --unshallow
+      - uses: actions/setup-go@v3
+        with:
+          go-version: 1.18
+          check-latest: true
+      - uses: imjasonh/setup-ko@v0.6 # This installs the current latest release.
+      - uses: sigstore/cosign-installer@v2.8.1
+      - run: |
+          tag=$(echo ${{ github.ref }} | cut -c11-) # get tag name without tags/refs/ prefix.
+          img=$(ko build --bare --platform=all -t latest -t ${{ github.sha }} -t ${tag} ./)
+          echo "built ${img}"
+          cosign sign ${img} \
+              -a sha=${{ github.sha }} \
+              -a run_id=${{ github.run_id }} \
+              -a run_attempt=${{ github.run_attempt }} \
+              -a tag=${tag}
+
   provenance:
     needs: [goreleaser]
     permissions: