mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
80 lines
2.6 KiB
YAML
80 lines
2.6 KiB
YAML
name: Attest Provenance
|
|
|
|
# Generates SLSA build-provenance attestations for an already-published release,
|
|
# so no image rebuild is required. Dispatch it after a release once the image
|
|
# manifest and source archives exist. Provenance is pushed to the registries as
|
|
# OCI referrers (verify with: gh attestation verify oci://<image>@<digest>).
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: "Release version without the leading v (e.g. 2.0.0)"
|
|
required: true
|
|
type: string
|
|
image_digest:
|
|
description: "Multi-arch manifest digest, sha256:... (same on both registries)"
|
|
required: true
|
|
type: string
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
image:
|
|
name: Attest image
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
id-token: write
|
|
attestations: write
|
|
packages: write
|
|
contents: read
|
|
steps:
|
|
- name: Log in to GitHub Container Registry
|
|
uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.repository_owner }}
|
|
password: ${{ secrets.GHCR_TOKEN }}
|
|
|
|
- name: Log in to Docker Hub
|
|
uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- name: Attest GHCR image
|
|
uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
|
|
with:
|
|
subject-name: ghcr.io/snapotter-hq/snapotter
|
|
subject-digest: ${{ inputs.image_digest }}
|
|
push-to-registry: true
|
|
|
|
- name: Attest Docker Hub image
|
|
uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
|
|
with:
|
|
subject-name: docker.io/snapotter/snapotter
|
|
subject-digest: ${{ inputs.image_digest }}
|
|
push-to-registry: true
|
|
|
|
archives:
|
|
name: Attest source archives
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
id-token: write
|
|
attestations: write
|
|
contents: read
|
|
steps:
|
|
- name: Download release archives
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
REPO: ${{ github.repository }}
|
|
VERSION: ${{ inputs.version }}
|
|
run: |
|
|
gh release download "v${VERSION}" --repo "$REPO" --pattern 'snapotter-v*-linux-*.tar.gz'
|
|
ls -l snapotter-v*-linux-*.tar.gz
|
|
|
|
- name: Attest archives
|
|
uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
|
|
with:
|
|
subject-path: "snapotter-v*-linux-*.tar.gz"
|