1- name : GrandNode Docker Release
1+ name : GrandNode Docker GHCR
22
33on :
44 push :
2525 steps :
2626 - name : Checkout
2727 uses : actions/checkout@v5
28+ with :
29+ fetch-depth : 0
2830
2931 - name : Login to GHCR
3032 uses : docker/login-action@v4
@@ -50,24 +52,39 @@ jobs:
5052 org.opencontainers.image.source=https://github.com/grandnode/grandnode2
5153 org.opencontainers.image.version=${{ env.VERSION }}
5254 org.opencontainers.image.revision=${{ github.sha }}
55+ org.opencontainers.image.description=GrandNode Docker test image
5356
57+ # BuildKit native attestations
5458 sbom : true
5559 provenance : mode=max
5660
61+ # GitHub Actions BuildKit cache
5762 cache-from : type=gha
5863 cache-to : type=gha,mode=max
5964
6065 - name : Install Cosign
6166 uses : sigstore/cosign-installer@v4.1.2
6267
63- - name : Show image information
68+ - name : Show release information
6469 run : |
70+ echo "========================================"
71+ echo "GrandNode Docker Test"
72+ echo "========================================"
73+
6574 echo "Image:"
6675 echo "${REGISTRY}/${IMAGE_NAME}:${VERSION}"
6776
68- echo "Digest:"
77+ echo "Git ref:"
78+ echo "${GITHUB_REF}"
79+
80+ echo "Git commit:"
81+ echo "${GITHUB_SHA}"
82+
83+ echo "Docker digest:"
6984 echo "${{ steps.build.outputs.digest }}"
7085
86+ echo "========================================"
87+
7188 - name : Cosign keyless sign
7289 env :
7390 IMAGE : ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
85102 cosign verify \
86103 "${IMAGE}@${DIGEST}" \
87104 --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
88- --certificate-identity-regexp="https://github.com/grandnode/grandnode2/.github/workflows/docker-release .yml@refs/heads/.*"
105+ --certificate-identity-regexp="https://github.com/grandnode/grandnode2/.github/workflows/docker-ghcr .yml@refs/heads/.*"
89106
90- - name : Verify SBOM
107+ - name : Verify SBOM attestation
91108 env :
92109 IMAGE : ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
93110 DIGEST : ${{ steps.build.outputs.digest }}
96113 "${IMAGE}@${DIGEST}" \
97114 --type spdx \
98115 --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
99- --certificate-identity-regexp="https://github.com/grandnode/grandnode2/.github/workflows/docker-release .yml@refs/heads/.*"
116+ --certificate-identity-regexp="https://github.com/grandnode/grandnode2/.github/workflows/docker-ghcr .yml@refs/heads/.*"
100117
101- - name : Verify SLSA provenance
118+ - name : Verify SLSA provenance attestation
102119 env :
103120 IMAGE : ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
104121 DIGEST : ${{ steps.build.outputs.digest }}
@@ -107,4 +124,4 @@ jobs:
107124 "${IMAGE}@${DIGEST}" \
108125 --type slsaprovenance \
109126 --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
110- --certificate-identity-regexp="https://github.com/grandnode/grandnode2/.github/workflows/docker-release .yml@refs/heads/.*"
127+ --certificate-identity-regexp="https://github.com/grandnode/grandnode2/.github/workflows/docker-ghcr .yml@refs/heads/.*"
0 commit comments