feat(ci): Verify base image before building

ponzienjoyer · Dec 19, 2023 · 6ecdbf1 · 6ecdbf1
1 parent b6f624c
commit 6ecdbf1
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -64,6 +64,12 @@ jobs:
           - base_name: bazzite-nvidia
             base_image_flavor: framework
     steps:
+      - name: Verify base image
+        uses: EyeCantCU/cosign-action/verify@v0.1.2
+        with:
+          container: ghcr.io/${{ github.repository_owner }}/${{ matrix.base_image_name }}-${{ matrix.base_image_flavor }}
+          pubkey: https://raw.githubusercontent.com/ublue-os/main/main/cosign.pub
+
       - name: Maximize build space
         uses: ublue-os/remove-unwanted-software@v6