Merge pull request #483 from com-pas/task/implement-signed-release

chore: update release workflow to include image signing

Author: noraeb

.github/workflows/release-project.yml

@@ -13,13 +13,19 @@ jobs:
     name: Build and publish
     runs-on: ubuntu-latest
     timeout-minutes: 45
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
         with:
           submodules: 'true'
 
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 #v4.1.2
+
       - name: Cache Docker Register
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae #v5
         with:
@@ -49,6 +55,7 @@ jobs:
           npm ci
           npm run-script build
       - name: Build and push docker image to Docker Hub
+        id: build-push
         uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f #v7.1.0
         with:
           # Set the context to use the packages/compas-open-scd directory and not execute it's own git checkout.
@@ -58,3 +65,7 @@ jobs:
           tags: |
             lfenergy/compas-open-scd:${{ steps.extract_tagname.outputs.tagname }}
             lfenergy/compas-open-scd:latest
+
+      - name: Sign Docker image with Cosign
+        run: |
+          cosign sign --yes lfenergy/compas-open-scd@${{ steps.build-push.outputs.digest }}

SECURITY.md

@@ -2,5 +2,20 @@
 
 ## Reporting a Vulnerability
 
-Please go to [Security Advisories](https://github.com/com-pas/compas-open-scd/security/advisories) to privately report a security vulnerability, 
+Please go to [Security Advisories](https://github.com/com-pas/compas-open-scd/security/advisories) to privately report a security vulnerability,
 our contributors will try to respond within a week of your report with a rough plan for a fix and new tests.
+
+## Verifying Docker images
+
+Docker images published by this project are signed using [Cosign](https://github.com/sigstore/cosign) keyless signing via [Sigstore](https://www.sigstore.dev/). Signatures are recorded in the public [Rekor](https://rekor.sigstore.dev/) transparency log — no private key is stored or required.
+
+To verify an image, install Cosign ([instructions](https://docs.sigstore.dev/cosign/system_config/installation/)) and run:
+
+```sh
+cosign verify \
+  --certificate-identity-regexp "https://github.com/com-pas/compas-open-scd/.github/workflows/release-project.yml@refs/tags/.*" \
+  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+  lfenergy/compas-open-scd:<tag>
+```
+
+Replace `<tag>` with the specific release tag (e.g. `v1.2.3`) or `latest`.