From c0a9c55891dd3192568cbda4d05885f9e2f21b81 Mon Sep 17 00:00:00 2001
From: Matt Bishop <mbishop@bitwarden.com>
Date: Fri, 13 Dec 2024 10:26:45 -0500
Subject: [PATCH] Fix image path formation for Cosign (#5151)

---
 .github/workflows/build.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 85c24b88c1..420b9b6375 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -292,14 +292,15 @@ jobs:
         if: github.event_name != 'pull_request_target' && github.ref == 'refs/heads/main'
         uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
 
-      - name: Sign images with Cosign
+      - name: Sign image with Cosign
         if: github.event_name != 'pull_request_target' && github.ref == 'refs/heads/main'
         env:
           DIGEST: ${{ steps.build-docker.outputs.digest }}
           TAGS: ${{ steps.image-tags.outputs.tags }}
         run: |
+          IFS="," read -a tags <<< "${TAGS}"
           images=""
-          for tag in ${TAGS}; do
+          for tag in "${tags[@]}"; do
             images+="${tag}@${DIGEST} "
           done
           cosign sign --yes ${images}