sign images using cosign

Signed-off-by: Gaël Goinvic <gaelg@element.io>

.github/workflows/dockerhub.yaml

@@ -26,6 +26,9 @@ jobs:
               with:
                   fetch-depth: 0 # needed for docker-package to be able to calculate the version
 
+            - name: Install Cosign
+              uses: sigstore/cosign-installer@v3.3.0
+
             - name: Prepare
               if: matrix.prepare
               run: ${{ matrix.prepare }}
@@ -58,6 +61,7 @@ jobs:
                       ${{ matrix.flavor }}
 
             - name: Build and push
+              id: build-and-push
               uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5
               with:
                   context: .
@@ -66,6 +70,17 @@ jobs:
                   tags: ${{ steps.meta.outputs.tags }}
                   labels: ${{ steps.meta.outputs.labels }}
 
+            - name: Sign the images with GitHub OIDC Token
+              env:
+                DIGEST: ${{ steps.build-and-push.outputs.digest }}
+                TAGS: ${{ steps.meta.outputs.tags }}
+              run: |
+                images=""
+                for tag in ${TAGS}; do
+                  images+="${tag}@${DIGEST} "
+                done
+                cosign sign --yes ${images}
+
             - name: Update repo description
               if: matrix.variant == 'vanilla'
               uses: peter-evans/dockerhub-description@dc67fad7001ef9e8e3c124cb7a64e16d0a63d864 # v3