bash 5 lines · 1 tab

Signed release artifacts with cosign for software supply chain trust

Kai Nakamura Apr 2026

1 tab

#!/usr/bin/env bash
set -euo pipefail

cosign sign --key env://COSIGN_PRIVATE_KEY ghcr.io/example/codesnips:${GITHUB_SHA}
cosign verify --key env://COSIGN_PUBLIC_KEY ghcr.io/example/codesnips:${GITHUB_SHA}

1 file · bash Explain with highlit

Artifact signing gives downstream systems something concrete to verify before deployment. I use cosign because it keeps container and provenance signing practical in CI. Supply chain controls only matter if verification is automated where release decisions happen.

Related snips

bash

#!/usr/bin/env bash
set -euo pipefail

bundle exec bundler-audit check --update
npm audit --audit-level=high
pip-audit --strict

Dependency vulnerability scanning for Ruby and Node projects

dependency-scanning supply-chain ruby

by Kai Nakamura 1 tab

yaml

- name: Build image
  run: docker build -t app:${{ github.sha }} .

- name: Scan image
  uses: aquasecurity/trivy-action@0.24.0
  with:

Trivy image scanning in pull request pipelines

trivy containers ci

by Kai Nakamura 1 tab

bash

#!/usr/bin/env bash
# Docker Networking Modes & Configuration

# === List networks ===
docker network ls
docker network inspect bridge

Docker networking: bridge, host, and overlay networks

docker networking containers

by Ryan Nakamura 1 tab

dockerfile

FROM node:20-alpine AS base
WORKDIR /app
RUN apk add --no-cache libc6-compat

FROM base AS deps
COPY package.json package-lock.json ./

Docker multi-stage build for Next.js

docker nextjs multi-stage

by codesnips 4 tabs

bash

#!/usr/bin/env bash
set -euo pipefail

# Container Registry Management & Image Lifecycle

# ============================================

Container registry management and image lifecycle

docker registry ecr

by Ryan Nakamura 1 tab

bash

#!/bin/bash
# Docker Compose commands

# Start all services
docker compose up -d

Docker Compose for multi-container applications

docker docker-compose devops

by Ryan Nakamura 2 tabs

Share this code

Here's the card — post it anywhere.

Signed release artifacts with cosign for software supply chain trust — share card

Link copied