Skip to content

Commit 4d999cb

Browse files
anthony-nhsanthony-nhs
committed
add attestation
1 parent 469314c commit 4d999cb

1 file changed

Lines changed: 204 additions & 0 deletions

File tree

‎.github/workflows/build_multi_arch_image.yml‎

Lines changed: 204 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,56 @@ jobs:
136136
DOCKER_TAG: ${{ inputs.docker_tag }}
137137
CONTAINER_NAME: '${{ inputs.container_name }}'
138138
ARCHITECTURE: '${{ matrix.arch }}'
139+
- name: Resolve image digest
140+
id: resolve_arch_digest
141+
run: |
142+
DIGEST=$(docker buildx imagetools inspect "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}-${ARCHITECTURE}" | awk '/^Digest:/ {print $2; exit}')
143+
echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
144+
echo "Resolved digest ${DIGEST} for ${DOCKER_TAG}-${ARCHITECTURE}"
145+
env:
146+
DOCKER_TAG: ${{ inputs.docker_tag }}
147+
CONTAINER_NAME: '${{ inputs.container_name }}'
148+
ARCHITECTURE: '${{ matrix.arch }}'
149+
- name: Attest image
150+
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a
151+
with:
152+
subject-name: ghcr.io/nhsdigital/eps-devcontainers/${{ inputs.container_name }}
153+
subject-digest: ${{ steps.resolve_arch_digest.outputs.digest }}
154+
push-to-registry: true
155+
create-storage-record: false
156+
- name: Summarise attested image
157+
run: |
158+
echo "## ATTESTED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}-${ARCHITECTURE}@${DIGEST}" >> "$GITHUB_STEP_SUMMARY"
159+
env:
160+
DOCKER_TAG: ${{ inputs.docker_tag }}
161+
CONTAINER_NAME: '${{ inputs.container_name }}'
162+
ARCHITECTURE: '${{ matrix.arch }}'
163+
DIGEST: ${{ steps.resolve_arch_digest.outputs.digest }}
164+
- name: Resolve github actions image digest
165+
id: resolve_githubactions_arch_digest
166+
run: |
167+
DIGEST=$(docker buildx imagetools inspect "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}-${ARCHITECTURE}" | awk '/^Digest:/ {print $2; exit}')
168+
echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
169+
echo "Resolved digest ${DIGEST} for githubactions-${DOCKER_TAG}-${ARCHITECTURE}"
170+
env:
171+
DOCKER_TAG: ${{ inputs.docker_tag }}
172+
CONTAINER_NAME: '${{ inputs.container_name }}'
173+
ARCHITECTURE: '${{ matrix.arch }}'
174+
- name: Attest github actions image
175+
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a
176+
with:
177+
subject-name: ghcr.io/nhsdigital/eps-devcontainers/${{ inputs.container_name }}
178+
subject-digest: ${{ steps.resolve_githubactions_arch_digest.outputs.digest }}
179+
push-to-registry: true
180+
create-storage-record: false
181+
- name: Summarise attested github actions image
182+
run: |
183+
echo "## ATTESTED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}-${ARCHITECTURE}@${DIGEST}" >> "$GITHUB_STEP_SUMMARY"
184+
env:
185+
DOCKER_TAG: ${{ inputs.docker_tag }}
186+
CONTAINER_NAME: '${{ inputs.container_name }}'
187+
ARCHITECTURE: '${{ matrix.arch }}'
188+
DIGEST: ${{ steps.resolve_githubactions_arch_digest.outputs.digest }}
139189
- name: Push latest image
140190
if: ${{ inputs.tag_latest }}
141191
run: |
@@ -152,6 +202,58 @@ jobs:
152202
DOCKER_TAG: ${{ inputs.docker_tag }}
153203
CONTAINER_NAME: '${{ inputs.container_name }}'
154204
ARCHITECTURE: '${{ matrix.arch }}'
205+
- name: Resolve github actions latest image digest
206+
if: ${{ inputs.tag_latest }}
207+
id: resolve_githubactions_latest_arch_digest
208+
run: |
209+
DIGEST=$(docker buildx imagetools inspect "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest-${ARCHITECTURE}" | awk '/^Digest:/ {print $2; exit}')
210+
echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
211+
echo "Resolved digest ${DIGEST} for githubactions-latest-${ARCHITECTURE}"
212+
env:
213+
CONTAINER_NAME: '${{ inputs.container_name }}'
214+
ARCHITECTURE: '${{ matrix.arch }}'
215+
- name: Attest github actions latest image
216+
if: ${{ inputs.tag_latest }}
217+
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a
218+
with:
219+
subject-name: ghcr.io/nhsdigital/eps-devcontainers/${{ inputs.container_name }}
220+
subject-digest: ${{ steps.resolve_githubactions_latest_arch_digest.outputs.digest }}
221+
push-to-registry: true
222+
create-storage-record: false
223+
- name: Summarise attested github actions latest image
224+
if: ${{ inputs.tag_latest }}
225+
run: |
226+
echo "## ATTESTED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest-${ARCHITECTURE}@${DIGEST}" >> "$GITHUB_STEP_SUMMARY"
227+
env:
228+
CONTAINER_NAME: '${{ inputs.container_name }}'
229+
ARCHITECTURE: '${{ matrix.arch }}'
230+
DIGEST: ${{ steps.resolve_githubactions_latest_arch_digest.outputs.digest }}
231+
- name: Resolve latest image digest
232+
if: ${{ inputs.tag_latest }}
233+
id: resolve_latest_arch_digest
234+
run: |
235+
DIGEST=$(docker buildx imagetools inspect "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest-${ARCHITECTURE}" | awk '/^Digest:/ {print $2; exit}')
236+
echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
237+
echo "Resolved digest ${DIGEST} for latest-${ARCHITECTURE}"
238+
env:
239+
CONTAINER_NAME: '${{ inputs.container_name }}'
240+
ARCHITECTURE: '${{ matrix.arch }}'
241+
- name: Attest latest image
242+
if: ${{ inputs.tag_latest }}
243+
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a
244+
with:
245+
subject-name: ghcr.io/nhsdigital/eps-devcontainers/${{ inputs.container_name }}
246+
subject-digest: ${{ steps.resolve_latest_arch_digest.outputs.digest }}
247+
push-to-registry: true
248+
create-storage-record: false
249+
- name: Summarise attested latest image
250+
if: ${{ inputs.tag_latest }}
251+
run: |
252+
echo "## ATTESTED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest-${ARCHITECTURE}@${DIGEST}" >> "$GITHUB_STEP_SUMMARY"
253+
env:
254+
CONTAINER_NAME: '${{ inputs.container_name }}'
255+
ARCHITECTURE: '${{ matrix.arch }}'
256+
DIGEST: ${{ steps.resolve_latest_arch_digest.outputs.digest }}
155257
publish_combined_image:
156258
name: Publish combined image for ${{ inputs.container_name }}
157259
runs-on: ubuntu-22.04
@@ -222,3 +324,105 @@ jobs:
222324
env:
223325
DOCKER_TAG: ${{ inputs.docker_tag }}
224326
CONTAINER_NAME: '${{ inputs.container_name }}'
327+
328+
- name: Resolve combined image digest
329+
id: resolve_combined_digest
330+
run: |
331+
DIGEST=$(docker buildx imagetools inspect "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}" | awk '/^Digest:/ {print $2; exit}')
332+
echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
333+
echo "Resolved digest ${DIGEST} for ${DOCKER_TAG}"
334+
env:
335+
DOCKER_TAG: ${{ inputs.docker_tag }}
336+
CONTAINER_NAME: '${{ inputs.container_name }}'
337+
338+
- name: Attest combined image
339+
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a
340+
with:
341+
subject-name: ghcr.io/nhsdigital/eps-devcontainers/${{ inputs.container_name }}
342+
subject-digest: ${{ steps.resolve_combined_digest.outputs.digest }}
343+
push-to-registry: true
344+
create-storage-record: false
345+
- name: Summarise attested combined image
346+
run: |
347+
echo "## ATTESTED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}@${DIGEST}" >> "$GITHUB_STEP_SUMMARY"
348+
env:
349+
DOCKER_TAG: ${{ inputs.docker_tag }}
350+
CONTAINER_NAME: '${{ inputs.container_name }}'
351+
DIGEST: ${{ steps.resolve_combined_digest.outputs.digest }}
352+
353+
- name: Resolve combined github actions image digest
354+
id: resolve_githubactions_combined_digest
355+
run: |
356+
DIGEST=$(docker buildx imagetools inspect "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}" | awk '/^Digest:/ {print $2; exit}')
357+
echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
358+
echo "Resolved digest ${DIGEST} for githubactions-${DOCKER_TAG}"
359+
env:
360+
DOCKER_TAG: ${{ inputs.docker_tag }}
361+
CONTAINER_NAME: '${{ inputs.container_name }}'
362+
363+
- name: Attest combined github actions image
364+
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a
365+
with:
366+
subject-name: ghcr.io/nhsdigital/eps-devcontainers/${{ inputs.container_name }}
367+
subject-digest: ${{ steps.resolve_githubactions_combined_digest.outputs.digest }}
368+
push-to-registry: true
369+
create-storage-record: false
370+
- name: Summarise attested combined github actions image
371+
run: |
372+
echo "## ATTESTED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}@${DIGEST}" >> "$GITHUB_STEP_SUMMARY"
373+
env:
374+
DOCKER_TAG: ${{ inputs.docker_tag }}
375+
CONTAINER_NAME: '${{ inputs.container_name }}'
376+
DIGEST: ${{ steps.resolve_githubactions_combined_digest.outputs.digest }}
377+
378+
- name: Resolve latest github actions image digest
379+
if: ${{ inputs.tag_latest }}
380+
id: resolve_githubactions_latest_digest
381+
run: |
382+
DIGEST=$(docker buildx imagetools inspect "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest" | awk '/^Digest:/ {print $2; exit}')
383+
echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
384+
echo "Resolved digest ${DIGEST} for githubactions-latest"
385+
env:
386+
CONTAINER_NAME: '${{ inputs.container_name }}'
387+
388+
- name: Attest latest github actions image
389+
if: ${{ inputs.tag_latest }}
390+
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a
391+
with:
392+
subject-name: ghcr.io/nhsdigital/eps-devcontainers/${{ inputs.container_name }}
393+
subject-digest: ${{ steps.resolve_githubactions_latest_digest.outputs.digest }}
394+
push-to-registry: true
395+
create-storage-record: false
396+
- name: Summarise attested latest github actions image
397+
if: ${{ inputs.tag_latest }}
398+
run: |
399+
echo "## ATTESTED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest@${DIGEST}" >> "$GITHUB_STEP_SUMMARY"
400+
env:
401+
CONTAINER_NAME: '${{ inputs.container_name }}'
402+
DIGEST: ${{ steps.resolve_githubactions_latest_digest.outputs.digest }}
403+
404+
- name: Resolve latest image digest
405+
if: ${{ inputs.tag_latest }}
406+
id: resolve_latest_digest
407+
run: |
408+
DIGEST=$(docker buildx imagetools inspect "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest" | awk '/^Digest:/ {print $2; exit}')
409+
echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
410+
echo "Resolved digest ${DIGEST} for latest"
411+
env:
412+
CONTAINER_NAME: '${{ inputs.container_name }}'
413+
414+
- name: Attest latest image
415+
if: ${{ inputs.tag_latest }}
416+
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a
417+
with:
418+
subject-name: ghcr.io/nhsdigital/eps-devcontainers/${{ inputs.container_name }}
419+
subject-digest: ${{ steps.resolve_latest_digest.outputs.digest }}
420+
push-to-registry: true
421+
create-storage-record: false
422+
- name: Summarise attested latest image
423+
if: ${{ inputs.tag_latest }}
424+
run: |
425+
echo "## ATTESTED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest@${DIGEST}" >> "$GITHUB_STEP_SUMMARY"
426+
env:
427+
CONTAINER_NAME: '${{ inputs.container_name }}'
428+
DIGEST: ${{ steps.resolve_latest_digest.outputs.digest }}

0 commit comments

Comments
 (0)