try to fix the devcontainer cosign

Signed-off-by: Justin Pflueger <[email protected]>

.github/workflows/docker.yaml

@@ -23,12 +23,11 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       # Install the cosign tool except on PR
       # https://github.com/sigstore/cosign-installer
       - name: Install cosign
-        if: github.event_name != 'pull_request'
         uses: sigstore/[email protected]
 
       - name: Set up QEMU
@@ -66,11 +65,16 @@ jobs:
           skipContainerUserIdUpdate: true
           platform: linux/amd64,linux/arm64
           runCmd: spin --version
+          push: always
 
       # Sign the resulting Docker image digest except on PRs.
       - name: Sign the published Docker image
-        if: ${{ github.event_name != 'pull_request' }}
         env:
+          IMAGE: ghcr.io/${{ github.repository }}
           TAGS: ${{ steps.meta.outputs.tags }}
-          DIGEST: ${{ steps.build-and-push.outputs.digest }}
-        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
+        run: |
+          for tag in "${TAGS[@]}"; do
+            IMAGE_TAG="ghcr.io/${IMAGE}:${tag}"
+            DIGEST=$(docker image ls "$IMAGE_TAG" --digests --format='{{.Digest}}')
+            cosign sign --yes "${IMAGE_TAG}@${DIGEST}"
+          done