mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
SnapOtterandGitHub
b6fdabaea8
Stop pushing SLSA attestations to the registries as OCI referrer tags (attest.yml: push-to-registry: false) and disable buildx's default provenance sidecars (release.yml: provenance: false). GHCR rendered both as package versions / unknown-unknown architecture entries on the package page. The release/publish flow (publish-images gate, RELEASE_TOKEN, web Sentry DSN) is unchanged.
70 lines
2.3 KiB
YAML
70 lines
2.3 KiB
YAML
name: Attest Provenance
|
|
|
|
# Generates SLSA build-provenance attestations for an already-published release,
|
|
# so no image rebuild is required. Dispatch it after a release once the image
|
|
# manifest and source archives exist.
|
|
#
|
|
# Keep image attestations in GitHub's attestation API instead of pushing them
|
|
# back to registries. GHCR renders OCI fallback sha256-* attestation tags as
|
|
# package versions, which makes the package page recommend non-runtime artifacts.
|
|
# Verify with: gh attestation verify oci://<image>@<digest> -R snapotter-hq/SnapOtter
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: "Release version without the leading v (e.g. 2.0.0)"
|
|
required: true
|
|
type: string
|
|
image_digest:
|
|
description: "Multi-arch manifest digest, sha256:... (same on both registries)"
|
|
required: true
|
|
type: string
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
image:
|
|
name: Attest image
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
id-token: write
|
|
attestations: write
|
|
contents: read
|
|
steps:
|
|
- name: Attest GHCR image
|
|
uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
|
|
with:
|
|
subject-name: ghcr.io/snapotter-hq/snapotter
|
|
subject-digest: ${{ inputs.image_digest }}
|
|
push-to-registry: false
|
|
|
|
- name: Attest Docker Hub image
|
|
uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
|
|
with:
|
|
subject-name: docker.io/snapotter/snapotter
|
|
subject-digest: ${{ inputs.image_digest }}
|
|
push-to-registry: false
|
|
|
|
archives:
|
|
name: Attest source archives
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
id-token: write
|
|
attestations: write
|
|
contents: read
|
|
steps:
|
|
- name: Download release archives
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
REPO: ${{ github.repository }}
|
|
VERSION: ${{ inputs.version }}
|
|
run: |
|
|
gh release download "v${VERSION}" --repo "$REPO" --pattern 'snapotter-v*-linux-*.tar.gz'
|
|
ls -l snapotter-v*-linux-*.tar.gz
|
|
|
|
- name: Attest archives
|
|
uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
|
|
with:
|
|
subject-path: "snapotter-v*-linux-*.tar.gz"
|