Revert "Sign published image manifests with cosign"

This reverts commit b5fc7b2.

Author: Wuodan

.github/workflows/build.yaml

@@ -21,10 +21,6 @@ on:
 env:
   IMAGE_NAME: ${{ inputs.image_name || vars.IMAGE_NAME || 'nikolaik/python-nodejs' }}
 
-permissions:
-  contents: write
-  id-token: write
-
 jobs:
   generate-matrix:
     name: Generate build matrix
@@ -116,21 +112,15 @@ jobs:
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Push multi-arch manifest
-        id: push-manifest
-        run: |
-          digest="$(docker manifest push "${IMAGE_NAME}:${{ matrix.key }}" | tail -n1)"
-          echo "digest=${digest}" >> "$GITHUB_OUTPUT"
-
-      - name: Install Cosign
-        uses: sigstore/cosign-installer@v4.0.0
+        run: docker manifest push "${IMAGE_NAME}:${{ matrix.key }}"
 
-      - name: Sign multi-arch manifest
-        run: cosign sign --yes "${IMAGE_NAME}@${{ steps.push-manifest.outputs.digest }}"
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
 
       - name: Add digest to build context
         run: |
           mkdir builds/
-          digest="${{ steps.push-manifest.outputs.digest }}"
+          digest="$(docker buildx imagetools inspect "${IMAGE_NAME}:${{ matrix.key }}" | awk '/^Digest:/ {print $2}')"
           echo '${{ toJSON(matrix) }}' | jq --arg digest "$digest" '. +={"digest": $digest}' >> "builds/${{ matrix.key }}.json"
 
       - name: Upload build context