fix(ci): add annotations param to imagetools

Author: tobiasehlert

.github/workflows/build.yml

@@ -186,6 +186,7 @@ jobs:
         run: |
           # Create the manifest list and push to both registries
           docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(jq -r '.annotations | to_entries[] | "--annotation \(.key)=\(.value)"' <<<"$DOCKER_METADATA_OUTPUT_JSON")
             $(printf '${{ env.CONTAINER_IMAGE }}@sha256:%s ' *) \
             $(printf 'ghcr.io/${{ env.CONTAINER_IMAGE }}@sha256:%s ' *)
 
@@ -203,6 +204,14 @@ jobs:
           docker buildx imagetools inspect ghcr.io/${{ env.CONTAINER_IMAGE }}:${{ steps.docker_meta.outputs.version }}
           echo "::endgroup::"
 
+      - name: Cosign sign images (GitHub OIDC)
+        run: |
+          cosign sign --yes \
+            ${{ env.CONTAINER_IMAGE }}@${{ steps.docker_build.outputs.digest }}
+
+          cosign sign --yes \
+            ghcr.io/${{ env.CONTAINER_IMAGE }}@${{ steps.docker_build.outputs.digest }}
+
       - name: Attest docker build (DockerHub)
         uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a #v3.0.0
         with:
@@ -217,14 +226,6 @@ jobs:
           subject-digest: ${{ steps.docker_build.outputs.digest }}
           push-to-registry: true
 
-      - name: Cosign sign images ('^'GitHub OIDC)
-        run: |
-          cosign sign --yes \
-            ${{ env.CONTAINER_IMAGE }}@${{ steps.docker_build.outputs.digest }}
-
-          cosign sign --yes \
-            ghcr.io/${{ env.CONTAINER_IMAGE }}@${{ steps.docker_build.outputs.digest }}
-
   argocd:
     if: github.event_name == 'release' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
     runs-on: ubuntu-latest