Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add image attestation workflow step #5158

Open
wants to merge 18 commits into
base: main
Choose a base branch
from
+13 −0
Open

feat: add image attestation workflow step #5158

Changes from 11 commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
20916e8
add image attestation workflow step
notdurson Dec 12, 2024
3f88102
feat: add image attestation workflow step
notdurson Dec 12, 2024
965eea6
add required permissions to workflow step
notdurson Dec 12, 2024
1ca63df
fix: change subject-path to name. add digest and push to registry
notdurson Dec 12, 2024
c72259d
Update .github/workflows/atlantis-image.yml
notdurson Dec 13, 2024
9abb1db
Update .github/workflows/atlantis-image.yml
notdurson Dec 13, 2024
6d7f2f7
Merge branch 'main' into signing-and-sbom
notdurson Dec 13, 2024
c5f931e
fix: identify build
notdurson Dec 13, 2024
6d18df7
Merge branch 'main' into signing-and-sbom
chenrui333 Dec 15, 2024
f503fa7
Update .github/workflows/atlantis-image.yml
chenrui333 Dec 15, 2024
44880f8
Merge branch 'main' into signing-and-sbom
notdurson Dec 16, 2024
de0084a
fix: Sign images using digest/repo instead of path
notdurson Dec 16, 2024
7cbdb53
remove unnecessary permissions in build step.
notdurson Dec 17, 2024
01ad76a
remove conditional for image attestation step
notdurson Dec 17, 2024
177e1a8
yes we actually need packages:write
notdurson Dec 17, 2024
d0c48e7
add contents:read back to permissions
notdurson Dec 18, 2024
b7bbb8c
Merge branch 'main' into signing-and-sbom
jamengual Dec 18, 2024
6c86a10
Merge branch 'main' into signing-and-sbom
notdurson Dec 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .github/workflows/atlantis-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,11 @@ jobs:
needs: [changes]
if: needs.changes.outputs.should-run-build == 'true'
name: Build Image
permissions:
id-token: write
packages: write
contents: read
attestations: write
notdurson marked this conversation as resolved.
Show resolved Hide resolved
strategy:
matrix:
image_type: [alpine, debian]
Expand Down Expand Up @@ -129,6 +134,7 @@ jobs:
run: echo "RELEASE_VERSION=${{ startsWith(github.ref, 'refs/tags/') && '${GITHUB_REF#refs/*/}' || 'dev' }}" >> $GITHUB_ENV

- name: "Build ${{ env.PUSH == 'true' && 'and push' || '' }} ${{ env.DOCKER_REPO }} image"
id: build
if: contains(fromJson('["push", "pull_request"]'), github.event_name)
uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6
with:
Expand All @@ -147,6 +153,14 @@ jobs:
labels: ${{ steps.meta.outputs.labels }}
outputs: type=image,name=target,annotation-index.org.opencontainers.image.description=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.description'] }}

- name: "Sign and Attest Image"
notdurson marked this conversation as resolved.
Show resolved Hide resolved
chenrui333 marked this conversation as resolved.
Show resolved Hide resolved
if: env.PUSH == 'true'
uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0
with:
subject-path: ${{ steps.build.outputs.image-name }}@${{ steps.build.outputs.digest }}
subject-digest: ${{ steps.build.outputs.digest }}
push-to-registry: true

test:
needs: [changes]
if: needs.changes.outputs.should-run-build == 'true'
Expand Down
Loading