ci: cosign all but the quay.io images for now

.github/workflows/ci.yaml

@@ -49,7 +49,10 @@ jobs:
         id: docker_meta
         uses: docker/metadata-action@v3
         with:
-          images: ghcr.io/miracum/fhir-pseudonymizer
+          images: |
+            ghcr.io/miracum/fhir-pseudonymizer
+            quay.io/miracum/fhir-pseudonymizer
+            harbor.miracum.org/miracum-etl/fhir-pseudonymizer
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v1
         if: ${{ github.event_name != 'pull_request' }}
@@ -64,6 +67,13 @@ jobs:
           registry: quay.io
           username: ${{ secrets.QUAY_IO_USERNAME }}
           password: ${{ secrets.QUAY_IO_TOKEN }}
+      - name: Login to MIRACUM Harbor Container Registry
+        uses: docker/login-action@v1
+        if: ${{ github.event_name != 'pull_request' }}
+        with:
+          registry: harbor.miracum.org
+          username: ${{ secrets.MIRACUM_REGISTRY_USERNAME }}
+          password: ${{ secrets.MIRACUM_REGISTRY_TOKEN }}
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1
       - name: Set up Docker Buildx
@@ -118,6 +128,10 @@ jobs:
           IMAGES: ${{ steps.docker_meta.outputs.tags }}
         run: |
           while read -r image; do
+            if [[ $image = quay.io/* ]]; then
+              echo "Skipping '$image' hosted on quay.io"
+              continue
+            fi
             echo "Signing $image"
             cosign sign -key /tmp/cosign.key "$image"
           done <<< "$IMAGES"

README.md

@@ -13,7 +13,11 @@ docker run --rm -i -p 8080:8080 ghcr.io/miracum/fhir-pseudonymizer:latest
 curl -X POST -H "Content-Type:application/fhir+json" "http://localhost:8080/fhir/\$de-identify" -d @benchmark/observation.json
 ```
 
-All container images are pushed to [ghcr.io/miracum/fhir-pseudonymizer](https://github.com/orgs/miracum/packages/container/package/fhir-pseudonymizer).
+Container images are pushed to the following registries:
+
+- `ghcr.io/miracum/fhir-pseudonymizer:latest`
+- `quay.io/miracum/fhir-pseudonymizer:latest`
+- `harbor.miracum.org/miracum-etl/fhir-pseudonymizer:latest`
 
 For deployment in Kubernetes see <https://github.com/miracum/charts/tree/master/charts/fhir-gateway> for a Helm Chart using the FHIR Pseudonymizer as one of its components.
 
@@ -142,6 +146,15 @@ Statistics        Avg      Stdev        Max
   Throughput:    12.97MB/s
 ```
 
+## Verify image integrity
+
+All released container images are signed using [cosign](https://github.com/sigstore/cosign).
+The public key hosted at <https://miracum.github.io/cosign.pub> (see [here](https://github.com/miracum/miracum.github.io) for the repository source) may be used to verify them:
+
+```sh
+cosign verify -key https://miracum.github.io/cosign.pub ghcr.io/miracum/fhir-pseudonymizer:latest
+```
+
 ## Attribution
 
 Icons made by [Freepik](https://www.freepik.com) from [Flaticon](https://www.flaticon.com/).