Merge pull request #11 from Devathmaj/security-hardening

Fix cosign sign image reference (lowercase OCI ref)

Author: Devathmaj

.github/workflows/release.yml

@@ -120,6 +120,11 @@ jobs:
       - name: Install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
+      - name: Lowercase image name (OCI references are case-sensitive)
+        run: echo "IMAGE_NAME=${IMAGE_NAME,,}" >> "$GITHUB_ENV"
+        env:
+          IMAGE_NAME: ${{ env.IMAGE_NAME }}
+
       - name: Sign the published Docker image
         env:
           IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}