Sign a container image keylessly with cosign and Sigstore using GitHub Actions OIDC

Steps

1. Add `id-token: write` permission to the GitHub Actions job so it can obtain an OIDC token from GitHub's token endpoint
2. Install cosign in the workflow step (use the `sigstore/cosign-installer` action or download the binary directly)
3. Build and push your container image to the registry; capture the image digest (not just the tag) — digest-based references are required for signing
4. Run `cosign sign --yes <image>@<digest>` — cosign requests a short-lived certificate from Fulcio using the OIDC token and records the signature in the Rekor transparency log
5. Distribute the image by digest and advise consumers to verify with `cosign verify --certificate-identity-regexp <expected-identity> --certificate-oidc-issuer https://token.actions.githubusercontent.com <image>@<digest>`
6. Optionally attach a Software Bill of Materials (SBOM) as a cosign attestation with `cosign attest --predicate sbom.json --type spdxjson <image>@<digest>`