Update Docker GHCR workflow and add image signing

Updated GitHub Actions workflow to use newer versions of actions and added image signing step.

Author: KrzysztofPajak

.github/workflows/docker-ghcr.yml

@@ -10,6 +10,7 @@ on:
 permissions:
   contents: read
   packages: write
+  id-token: write
 
 env:
   REGISTRY: ghcr.io
@@ -21,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Login to GHCR
         uses: docker/login-action@v3
@@ -31,6 +32,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push Docker image
+        id: build
         uses: docker/build-push-action@v6
         with:
           context: .
@@ -40,3 +42,13 @@ jobs:
           labels: |
             org.opencontainers.image.source=https://github.com/grandnode/grandnode2
             org.opencontainers.image.description=GrandNode GHCR private image test
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v4.0.0
+
+      - name: Sign Docker image
+        env:
+          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          DIGEST: ${{ steps.build.outputs.digest }}
+        run: |
+          cosign sign --yes "${IMAGE}@${DIGEST}"