From acf020b9d478d069a2160d65244dfa2afdaee596 Mon Sep 17 00:00:00 2001
From: Tianning Li <tianning.li@datadoghq.com>
Date: Thu, 5 Mar 2026 13:27:01 -0500
Subject: [PATCH] chore(ci): sign CI runner image with ddsign

Install ddsign in the CI Dockerfile and add image signing to the
`ci image` job, which builds the GitLab CI runner image used to
execute pipeline jobs. Adds the required GitLab OIDC id_token
(aud: image-integrity) and invokes ddsign sign after the push.

Fixes: https://datadoghq.atlassian.net/browse/SVLS-8644
---
 .gitlab-ci.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 8dbc4f9fc..2fe746831 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -23,10 +23,15 @@ ci image:
       changes:
         - .gitlab/Dockerfile
       when: on_success
+  id_tokens:
+    DDSIGN_ID_TOKEN:
+      aud: image-integrity
   variables:
     DOCKER_TARGET: ${DOCKER_TARGET_IMAGE}:${DOCKER_TARGET_VERSION}
   script:
-    - docker buildx build --platform linux/amd64,linux/arm64 --no-cache --pull --push --tag ${DOCKER_TARGET} -f .gitlab/Dockerfile .
+    - METADATA_FILE=$(mktemp)
+    - docker buildx build --platform linux/amd64,linux/arm64 --no-cache --pull --push --tag ${DOCKER_TARGET} --metadata-file ${METADATA_FILE} -f .gitlab/Dockerfile .
+    - ddsign sign ${DOCKER_TARGET} --docker-metadata-file ${METADATA_FILE}
 
 .go-cache: &go-cache
   key: datadog-lambda-extension-go-cache