[action] cosign over docker image digest

.github/workflows/release.yml

@@ -98,4 +98,10 @@ jobs:
         env:
           DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
           DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      - name: Cosign
+        id: cosign
+        run: |
+          DIGEST=$(docker images --digests --format "{{.Digest}}" smallstep/step-ca | head -n 1 | tr -d '[:space:]')
+          cosign sign -r smallstep/step-ca@${DIGEST}
+        env:
           COSIGN_EXPERIMENTAL: 1

make/docker.mk

@@ -54,7 +54,6 @@ define DOCKER_BUILDX
 	# $(1) -- Image Tag
 	# $(2) -- Push (empty is no push | --push will push to dockerhub)
 	docker buildx build . --progress plain -t $(DOCKER_IMAGE_NAME):$(1) -f docker/Dockerfile.step-ca --platform="$(DOCKER_PLATFORMS)" $(2)
-	cosign sign -r $(DOCKER_IMAGE_NAME):$(1)
 
 endef