Skip to content

build(deps): Bump distroless/static from f7f8f72 to 1c2c046 (#109) #8

build(deps): Bump distroless/static from f7f8f72 to 1c2c046 (#109)

build(deps): Bump distroless/static from f7f8f72 to 1c2c046 (#109) #8

Workflow file for this run

name: docker
on:
push:
tags: ['v*.*.*']
# Read-only baseline. The single job opts into the extra scopes it needs
# (GHCR push + cosign keyless OIDC) so the token surface stays narrow.
permissions:
contents: read
concurrency:
group: docker-${{ github.ref }}
# Never cancel an in-flight image publish. A re-pushed tag queues behind
# the running job instead of racing two pushes to the same reference.
cancel-in-progress: false
env:
IMAGE: ghcr.io/${{ github.repository }}
jobs:
gate:
name: gate
# The same fmt/clippy/build/test/deny gate pull requests must pass.
# The image is not pushed or signed without it — see gates.yml.
uses: ./.github/workflows/gates.yml
image:
name: build & push (ghcr)
needs: [gate]
runs-on: ubuntu-24.04 # was ubuntu-latest
permissions:
contents: read
packages: write # push the image to GHCR
id-token: write # cosign keyless OIDC + provenance OIDC
attestations: write # record SLSA build provenance for the image digest
# arm64 compiles under QEMU emulation, so the build is slow; give it room.
timeout-minutes: 90
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Set up QEMU (arm64 emulation)
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
- name: Log in to GHCR
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Derive image tags and labels
id: meta
uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
with:
images: ${{ env.IMAGE }}
tags: |
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
# `latest=auto` tags only the highest non-prerelease semver as
# `latest`, mirroring release.yml's prerelease handling.
flavor: |
latest=auto
- name: Build and push (linux/amd64, linux/arm64)
id: build
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: .
platforms: linux/amd64,linux/arm64
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
provenance: mode=max
sbom: true
cache-from: type=gha
cache-to: type=gha,mode=max
- name: Install cosign
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
with:
cosign-release: 'v2.4.3'
- name: Sign image by digest (sigstore keyless OIDC)
env:
COSIGN_YES: 'true'
DIGEST: ${{ steps.build.outputs.digest }}
# Sign the multi-arch manifest digest once; the signature covers every
# tag that points at it. Verify with the recipe in the README.
run: cosign sign --yes "${IMAGE}@${DIGEST}"
- name: Attest build provenance (image digest)
# GitHub-issued SLSA provenance for the manifest digest, pushed to
# GHCR alongside the image and verifiable with
# `gh attestation verify oci://<image>@<digest> --repo no42-org/onmsctl`.
# Separate from the buildx `provenance: mode=max` above: that is
# BuildKit's own attestation baked into the image; this is a
# GitHub attestation the `gh` CLI understands.
uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
with:
subject-name: ${{ env.IMAGE }}
subject-digest: ${{ steps.build.outputs.digest }}
push-to-registry: true