chore: signed release (#12355)

* chore: signed release

* fix: use single quotes

.env.me

@@ -1,12 +0,0 @@
-#################################################################################
-#                                                                               #
-#    This file uniquely authorizes you against this project in dotenv-vault.    #
-#                 Do NOT commit this file to source control.                    #
-#                                                                               #
-#                  Generated with 'npx dotenv-vault login'                      #
-#                                                                               #
-#                  Learn more at https://dotenv.org/env-me                      #
-#                                                                               #
-#################################################################################
-
-DOTENV_ME=me_dfea8212459cca5e918e43aeadaebb4b5324b2e14975c69dcbf54c543a732896

.github/workflows/docker-release.yml

@@ -37,10 +37,15 @@ jobs:
     permissions:
       packages: write
       contents: read
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v3
 
+      - name: Install cosign
+        if: github.event_name != 'pull_request'
+        uses: sigstore/cosign-installer@v3
+
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v2
 
@@ -73,6 +78,7 @@ jobs:
           flavor: latest=false
 
       - name: Build and push Docker image (ordinary version)
+        id: build-and-push
         uses: docker/build-push-action@v4
         with:
           context: .
@@ -82,8 +88,12 @@ jobs:
           platforms: linux/amd64,linux/arm/v7,linux/arm64
           cache-from: type=gha,scope=docker-release
           cache-to: type=gha,mode=max,scope=docker-release
-          # cache-from: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/rsshub:buildcache
-          # cache-to: type=registry,ref=${{ secrets.DOCKER_USERNAME }}/rsshub:buildcache,mode=max
+
+      - name: Sign the published Docker image
+        if: ${{ github.event_name != 'pull_request' }}
+        env:
+          COSIGN_EXPERIMENTAL: 'true'
+        run: echo "${{ steps.meta-ordinary.outputs.tags }}" | xargs -I {} cosign sign {}@${{ steps.build-and-push.outputs.digest }}
 
       - name: Extract Docker metadata (Chromium-bundled version)
         id: meta-chromium-bundled
@@ -98,6 +108,7 @@ jobs:
           flavor: latest=false
 
       - name: Build and push Docker image (Chromium-bundled version)
+        id: build-and-push-chromium
         uses: docker/build-push-action@v4
         with:
           context: .
@@ -108,10 +119,14 @@ jobs:
           platforms: linux/amd64,linux/arm/v7,linux/arm64
           cache-from: |
             type=registry,ref=${{ secrets.DOCKER_USERNAME }}/rsshub:chromium-bundled
-          # type=gha,scope=docker-release # not needed, Docker automatically uses local cache from the builder
-          # type=registry,ref=${{ secrets.DOCKER_USERNAME }}/rsshub:buildcache
           cache-to: type=inline,ref=${{ secrets.DOCKER_USERNAME }}/rsshub:chromium-bundled  # inline cache is enough
 
+      - name: Sign the published Docker image
+        if: ${{ github.event_name != 'pull_request' }}
+        env:
+          COSIGN_EXPERIMENTAL: 'true'
+        run: echo "${{ steps.meta-chromium-bundled.outputs.tags }}" | xargs -I {} cosign sign {}@${{ steps.build-and-push-chromium.outputs.digest }}
+
   description:
     runs-on: ubuntu-latest
     needs: check-env

.github/workflows/docker-test.yml

@@ -63,7 +63,6 @@ jobs:
         with:
           actions: 'add-labels'
           token: ${{ secrets.GITHUB_TOKEN }}
-          issue-number: ${{ github.event.issue.number }}
           labels: 'Route Test: Failed'
 
       - name: Test Docker image

.github/workflows/npm-publish.yml

@@ -29,6 +29,6 @@ jobs:
           git config --local user.name "GitHub Action"
           npx version-from-git --allow-same-version --template 'master.short'
       - name: Publish to npmjs
-        run: npm publish
+        run: npm publish --provenance --access public
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}