It works!

Pipeline git → build → push Harbor → sign cosign → deploy Portainer OK