Verify image on action (#169)

* Verify image on action * Fix validate
home-assistant · Jun 9, 2023 · 182db11 · 182db11
1 parent 093359f
commit 182db11
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/action.yml b/action.yml
@@ -8,6 +8,11 @@ inputs:
 runs:
   using: "composite"
   steps:
+    - name: Install Cosign
+      uses: sigstore/cosign-installer@v3.0.5
+      with:
+        cosign-release: "v2.0.2"
+
     - shell: bash
       id: version
       run: |
@@ -20,6 +25,10 @@ runs:
     - shell: bash
       run: |
         docker pull ghcr.io/home-assistant/amd64-builder:${{ steps.version.outputs.version }}
+        cosign verify \
+          --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+          --certificate-identity-regexp https://github.com/home-assistant/builder/.* \
+          ghcr.io/home-assistant/amd64-builder:${{ steps.version.outputs.version }}
 
     - shell: bash
       id: builder