From e9682abcd402c0f2bef3c2c435149e2196420266 Mon Sep 17 00:00:00 2001
From: yubiuser <github@yubiuser.dev>
Date: Mon, 16 Mar 2026 11:47:14 +0100
Subject: [PATCH] Disable signing to prevent sha tag-spam in the GHCR

Signed-off-by: yubiuser <github@yubiuser.dev>
---
 .github/workflows/ci.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 58b6220..0aa16b1 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -46,6 +46,8 @@ jobs:
         type=ref,event=pr
         type=ref,event=branch
       platforms: linux/amd64,linux/arm64
+      # FIXME: GHCR does not support the referrers API and spams the registry with sha-tagged images when cosigned: https://github.com/docker/github-builder/issues/109
+      sign: false
     secrets:
       registry-auths: |
         - registry: ghcr.io