mirror of
https://github.com/snapotter-hq/SnapOtter.git
synced 2026-08-03 07:46:42 +02:00
70 lines
2.3 KiB
YAML
70 lines
2.3 KiB
YAML
name: Attest Provenance
|
|
|
|
# Generates SLSA build-provenance attestations for an already-published release,
|
|
# so no image rebuild is required. Dispatch it after a release once the image
|
|
# manifest and source archives exist.
|
|
#
|
|
# Keep image attestations in GitHub's attestation API instead of pushing them
|
|
# back to registries. GHCR renders OCI fallback sha256-* attestation tags as
|
|
# package versions, which makes the package page recommend non-runtime artifacts.
|
|
# Verify with: gh attestation verify oci://<image>@<digest> -R snapotter-hq/SnapOtter
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: "Release version without the leading v (e.g. 2.0.0)"
|
|
required: true
|
|
type: string
|
|
image_digest:
|
|
description: "Multi-arch manifest digest, sha256:... (same on both registries)"
|
|
required: true
|
|
type: string
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
image:
|
|
name: Attest image
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
id-token: write
|
|
attestations: write
|
|
contents: read
|
|
steps:
|
|
- name: Attest GHCR image
|
|
uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
|
|
with:
|
|
subject-name: ghcr.io/snapotter-hq/snapotter
|
|
subject-digest: ${{ inputs.image_digest }}
|
|
push-to-registry: false
|
|
|
|
- name: Attest Docker Hub image
|
|
uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
|
|
with:
|
|
subject-name: docker.io/snapotter/snapotter
|
|
subject-digest: ${{ inputs.image_digest }}
|
|
push-to-registry: false
|
|
|
|
archives:
|
|
name: Attest source archives
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
id-token: write
|
|
attestations: write
|
|
contents: read
|
|
steps:
|
|
- name: Download release archives
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
REPO: ${{ github.repository }}
|
|
VERSION: ${{ inputs.version }}
|
|
run: |
|
|
gh release download "v${VERSION}" --repo "$REPO" --pattern 'snapotter-v*-linux-*.tar.gz'
|
|
ls -l snapotter-v*-linux-*.tar.gz
|
|
|
|
- name: Attest archives
|
|
uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
|
|
with:
|
|
subject-path: "snapotter-v*-linux-*.tar.gz"
|