supply-chain-onboarding

Automating container image signing in GitHub Actions CI pipelines involves using cosign to sign images during the build process. This Skill generates and tracks provenance for your images to secure your app's supply chain.

Kyverno cosign verification for CI pipeline images is a process that ensures container images are cryptographically signed and attested before deployment. It secures your supply chain by validating image provenance during admission checks.

Yes, you need both GitHub Actions and Kyverno to verify container images with cosign using this Skill. GitHub Actions runs the CI pipeline while Kyverno handles the verify-images and verify-attestations admission checks.

Your Kyverno verify-images admission check fails when your CI pipeline images have not been signed and attested correctly. You can run the 'cosign verify' command on your image to ensure it has been signed properly.

Setting up provenance tracking for container images in your deploy.yml workflow requires automating image signing with cosign in GitHub Actions. This Skill helps generate and track provenance for your app's deployment workflows.