在GitHub Actions中用Azure KeyVault+cosign签名镜像遇问题

本地执行cosign sign --key azurekms://<myvault>.vault.azure.net/<key-name> <my-image>可正常完成Docker镜像签名，但在GitHub Actions工作流中，通过OIDC方式登录Azure后，az keyvault key list命令能正常运行，执行Cosign签名命令cosign sign --key azurekms://MyKeyVault.vault.azure.net/MyKeyName myimage@digest时却报错：

Error: public key: public key: azure.BearerAuthorizer#WithAuthorization: Failed to refresh the Token for request to https://***.vault.azure.net/keys/MyKeyName/?api-version=7.1: StatusCode=400 -- Original Error: adal: Refresh request failed. Status Code = '400'. Response body: {"error":"invalid_request","error_description":"Identity not found"} Endpoint http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fvault.azure.net
main.go:74: error during command execution: public key: public key: azure.BearerAuthorizer#WithAuthorization: Failed to refresh the Token for request to https://***.vault.azure.net/keys/MyKeyName/?api-version=7.1: StatusCode=400 -- Original Error: adal: Refresh request failed. Status Code = '400'. Response body: {"error":"invalid_request","error_description":"Identity not found"} Endpoint http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fvault.azure.net

已尝试以下操作，但问题仍未解决：

• 使用带密钥的服务主体和基于联邦身份凭证的OIDC服务主体，结果无差异
• 调整权限范围，Azure CLI命令可正常执行，但Cosign始终失败

当前使用的GitHub Actions工作流如下：

name: Docker-Build
on:
  push:

permissions:
  id-token: write
  contents: read
  packages: write

jobs:
  build:

    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Setup Docker buildx
        uses: docker/setup-buildx-action@v2

      - name: Log into registry DockerHub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.MY_DOCKERHUB_USER }}
          password: ${{ secrets.MY_DOCKERHUB_TOKEN }}

      - name: Log in with Azure
        uses: azure/login@v1
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Build and push Docker image
        id: build-and-push
        uses: docker/build-push-action@v4
        with:
          tags: ${{ github.actor }}/myimage:${{ github.ref_name }}

      - name: Sign the published Docker image
        run: |
          # Works
          az keyvault key list --id {{ secrets.COSIGN_KEY_STORE }}
          # Does not work
          cosign sign --key ${{ secrets.COSIGN_KEY_STORE }} ${{ github.actor }}/myimage@${{ github.ref_name }}

内容的提问来源于stack exchange，提问作者hegerdes