fix(build-push-docker-manifest): idempotent manifest + cosign reruns (RANE-4683)

.changeset/rane-4683-manifest-cosign-hardening.md

@@ -0,0 +1,6 @@
+---
+"build-push-docker-manifest": minor
+"reusable-docker-build-publish": patch
+---
+
+Harden manifest create and cosign sign for idempotent build-publish reruns (RANE-4683): skip imagetools create when the tag already points at the expected platform digests, skip cosign sign when a valid signature is already present, retry manifest tag propagation after create to absorb ECR lag, and move the cosign verify gate (with 5×10s retry for Sigstore propagation) to reusable-docker-build-publish

.github/workflows/reusable-docker-build-publish.yml

@@ -562,7 +562,7 @@
     environment:
       name: ${{ inputs.environment }}
       # http://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/control-deployments#using-environments-without-deployments
       deployment: false
     runs-on: ${{ matrix.runner }}
     timeout-minutes: ${{ inputs.timeout }}
     strategy:
@@ -728,7 +728,7 @@
     environment:
       name: ${{ inputs.environment }}
       # http://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/control-deployments#using-environments-without-deployments
       deployment: false
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     outputs:
@@ -854,6 +854,45 @@
           aws-role-arn: ${{ secrets.AWS_ROLE_PUBLISH_ARN }}
           aws-region: ${{ inputs.aws-region-ecr }}
 
+      - name: Verify Docker manifest signature
+        if: ${{ inputs.docker-manifest-sign == 'true' }}
+        shell: bash
+        env:
+          MANIFEST_NAME_WITH_DIGEST: ${{ steps.docker-manifest.outputs.manifest-name-with-digest }}
+          GITHUB_WORKFLOW_REPOSITORY: ${{ inputs.github-workflow-repository }}
+          OIDC_ISSUER: https://token.actions.githubusercontent.com
+          OIDC_IDENTITY_REGEXP: "^https://github.com/smartcontractkit/.*$"
+        run: |
+          set -euo pipefail
+
+          MAX_RETRIES=5
+          RETRY_DELAY=10
+          VERIFY_OK=false
+
+          for i in $(seq 1 $MAX_RETRIES); do
+            echo "Attempt ${i}/${MAX_RETRIES}: Verifying cosign signature for ${MANIFEST_NAME_WITH_DIGEST}..."
+
+            if cosign verify "${MANIFEST_NAME_WITH_DIGEST}" \
+              --certificate-oidc-issuer "${OIDC_ISSUER}" \
+              --certificate-identity-regexp "${OIDC_IDENTITY_REGEXP}" \
+              --certificate-github-workflow-repository "${GITHUB_WORKFLOW_REPOSITORY}"; then
+              echo "Successfully verified signature on attempt ${i}"
+              VERIFY_OK=true
+              break
+            fi
+
+            echo "Attempt ${i}/${MAX_RETRIES}: Signature not yet available..."
+            if [[ "${i}" -lt "${MAX_RETRIES}" ]]; then
+              echo "Retrying in ${RETRY_DELAY}s..."
+              sleep "${RETRY_DELAY}"
+            fi
+          done
+
+          if [[ "$VERIFY_OK" != "true" ]]; then
+            echo "::error::Failed to verify cosign signature for ${MANIFEST_NAME_WITH_DIGEST} after ${MAX_RETRIES} attempts"
+            exit 1
+          fi
+
       # Attest only the manifest index. Build-provenance attestations do not
       # transfer from the per-arch images to the index, so the index is
       # attested explicitly here. Requires the calling job to grant