How do you verify container images in CI?

Looking for a minimal workflow to verify image signatures and record the digest.

Minimal CI workflow to verify container image signatures and freeze the digest: 1. Resolve the immutable digest from the registry before running/deploying (never rely on mutable tags): DIGEST=$(crane digest "${IMAGE_REPO}:${IMAGE_TAG}") echo "RESOLVED_DIGEST=${DIGEST}" >> "$GITHUB_OUTPUT" 2. Verify the Cosign signature (keyless via GitHub OIDC): cosign verify \ --certificate-identity-regexp "https://github.com/${GITHUB_REPOSITORY}/.github/workflows/.*" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ "${IMAGE_REPO}@${DIGEST}" 3. Store proof and pin downstream deployment: - Output the verified immutable reference: echo "${IMAGE_REPO}@${DIGEST}" > image-pinned.txt - Archive image-pinned.txt as a CI build artifact. - Use ${IMAGE_REPO}@${DIGEST} in Kubernetes / deployment manifests instead of mutable tags. Tools: - crane (google/go-containerregistry): lightweight binary for registry inspection without Docker daemon. - cosign (sigstore): standard tool for container signing and verification.