ci: sign the image with cosign (keyless)

[thejefflarson]

Signs each pushed watcher-server image with keyless cosign.

What it does

• Signs by immutable digest (not tag) right after build/push.
• Keyless — the job's GitHub OIDC token is exchanged for a short-lived Fulcio cert and the signature is recorded in the Rekor transparency log. No private key to generate, store, or rotate.
• Adds id-token: write, the sigstore/cosign-installer step, and reuses the existing GHCR docker login to push the signature.

Verify a signed image

cosign verify ghcr.io/thejefflarson/watcher-server@<digest> \
  --certificate-identity-regexp 'https://github.com/thejefflarson/watcher/\.github/workflows/ci\.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Watch on first run

The signing step needs egress from the self-hosted watcher-runners to Sigstore (fulcio.sigstore.dev, rekor.sigstore.dev) + the cosign release download. The runners already reach GHCR/registries, so this should be fine — but it's the thing to confirm on the first main build.

🤖 Generated with Claude Code