From 6bb77394010ca826252462edb1aca8eb054e38ef Mon Sep 17 00:00:00 2001
From: Quentin Gliech <quenting@element.io>
Date: Tue, 8 Feb 2022 09:04:39 +0100
Subject: [PATCH] Only sign docker image on tags and main branch

---
 .github/workflows/check.yaml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml
index d9124f952..36b1cd246 100644
--- a/.github/workflows/check.yaml
+++ b/.github/workflows/check.yaml
@@ -357,7 +357,11 @@ jobs:
             base.cache-to=type=registry,ref=${{ env.IMAGE }}:buildcache,mode=max
 
       - name: Sign the images with GitHub Actions provided token
-        if: github.event_name != 'pull_request'
+        # Only sign on tags and on commits on main branch
+        if: |
+          github.event_name != 'pull_request'
+          && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main')
+
         run: cosign sign ${TAGS}
         env:
           TAGS: "${{ steps.meta.outputs.tags }} ${{ steps.meta-debug.outputs.tags }}"