From 6297b421a6436cd2db9d5195b59c23bed12a5891 Mon Sep 17 00:00:00 2001
From: AYDEV-FR <aymeric.deliencourt@aydev.fr>
Date: Sun, 21 Jun 2026 10:03:00 +0200
Subject: [PATCH] fix(ci): authenticate cosign + lowercase image ref so v0.2.0
 signs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The first v0.2.0 release pushed every artifact but failed both cosign
signing steps:

- chart.yml: cosign reads ~/.docker/config.json, but the job only ran
  `helm registry login` (Helm's own credential store), so the signature
  push got UNAUTHORIZED. Add docker/login-action alongside the Helm login
  to populate both stores.
- release.yml: the cosign step signed `ghcr.io/${{ github.repository }}`,
  which is mixed-case (AYDEV-FR/dploy); OCI refs must be lowercase, so
  cosign failed with "could not parse reference". Lowercase the ref and
  sign the build's immutable digest instead of the mutable tag.

Both fixes only affect signing — the chart and images themselves were
already published successfully.

Claude-Session: https://claude.ai/code/session_01M4Dd5oASBGHwr6ts6wTnYn
---
 .github/workflows/chart.yml   | 13 ++++++++++++-
 .github/workflows/release.yml | 18 +++++++++++++-----
 2 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/chart.yml b/.github/workflows/chart.yml
index 482d78f..c174eb8 100644
--- a/.github/workflows/chart.yml
+++ b/.github/workflows/chart.yml
@@ -61,7 +61,18 @@ jobs:
           echo "owner=${GITHUB_REPOSITORY_OWNER,,}" >> "$GITHUB_OUTPUT"
           echo "version=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT"
 
-      - name: Log in to Container Registry
+      # Two credential stores need populating: docker/login-action writes
+      # ~/.docker/config.json (read by cosign when it pushes the signature),
+      # while helm push uses Helm's own registry config. Authenticating only
+      # one leaves the other UNAUTHORIZED.
+      - name: Log in to Container Registry (cosign)
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Log in to Helm registry
         run: |
           echo "${{ secrets.GITHUB_TOKEN }}" \
             | helm registry login "${REGISTRY}" --username "${{ github.actor }}" --password-stdin
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ccb3618..4d6518c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -141,6 +141,7 @@ jobs:
             type=semver,pattern={{major}}
 
       - name: Build and push
+        id: build
         uses: docker/build-push-action@v6
         with:
           context: .
@@ -153,14 +154,21 @@ jobs:
           build-args: |
             VERSION=${{ needs.release.outputs.version }}
 
-      - name: Sign container image
+      - name: Install cosign
         uses: sigstore/cosign-installer@v3
 
-      - name: Sign the images with cosign
-        run: |
-          cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.release.outputs.version }}
+      - name: Lowercase image reference
+        id: img
+        # github.repository is mixed-case (AYDEV-FR/dploy); OCI refs must be
+        # lowercase or cosign rejects them with "could not parse reference".
+        run: echo "name=${IMAGE_NAME,,}" >> "$GITHUB_OUTPUT"
         env:
-          COSIGN_EXPERIMENTAL: 1
+          IMAGE_NAME: ${{ env.IMAGE_NAME }}
+
+      - name: Sign the image with cosign
+        # Sign the immutable digest from the build, not the mutable tag.
+        run: |
+          cosign sign --yes "${REGISTRY}/${{ steps.img.outputs.name }}@${{ steps.build.outputs.digest }}"
 
   update-docs:
     name: Update Documentation