name: Sign an image
description: >-
  Sign a pushed image and every platform image behind it with netOrk's key, and
  attach what each was judged by (bin/sign.sh). The caller passes the secrets
  COSIGN_PRIVATE_KEY_B64 and COSIGN_PASSWORD as env of this step.
inputs:
  ref:
    description: The pushed image, <image>@<digest>
    required: true
  dir:
    description: The judge action's results, cis-<arch>.json and sbom-<arch>.cdx.json
    default: attest
  expect-platforms:
    description: The platforms the reference must hold, e.g. "amd64 arm64"; empty takes what is there
    default: ""
  attest-platforms:
    description: >-
      The platforms to attest, e.g. "arm64"; empty attests every one. A release
      index joins a new platform to one already attested.
    default: ""
runs:
  using: composite
  steps:
    - name: Install cosign
      shell: bash
      run: bash "${{ github.action_path }}/../../bin/install-cosign.sh"
    - name: Sign and attest
      shell: bash
      env:
        REF: ${{ inputs.ref }}
        DIR: ${{ inputs.dir }}
        EXPECT_PLATFORMS: ${{ inputs.expect-platforms }}
        ATTEST_PLATFORMS: ${{ inputs.attest-platforms }}
      run: bash "${{ github.action_path }}/../../bin/sign.sh" "$REF" "$DIR"