fix(sign): Store private key in environment

EyeCantCU · Dec 18, 2023 · b852ddf · b852ddf
1 parent 0a4c958
commit b852ddf
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/sign/action.yml b/sign/action.yml
@@ -41,7 +41,8 @@ runs:
     - name: Sign container image
       shell: bash
       run: |
-        cosign sign -y --key ${{ inputs.signing-secret }} ${{ inputs.container }}@${TAGS}
+        cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ inputs.container }}@${TAGS}
       env:
         COSIGN_EXPERIMENTAL: false
+        COSIGN_PRIVATE_KEY: ${{ inputs.signing-secret }}
         TAGS: ${{ inputs.tags }}