build(deps): Bump distroless/static from f7f8f72 to 1c2c046 (#109)
#8
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: docker | |
| on: | |
| push: | |
| tags: ['v*.*.*'] | |
| # Read-only baseline. The single job opts into the extra scopes it needs | |
| # (GHCR push + cosign keyless OIDC) so the token surface stays narrow. | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: docker-${{ github.ref }} | |
| # Never cancel an in-flight image publish. A re-pushed tag queues behind | |
| # the running job instead of racing two pushes to the same reference. | |
| cancel-in-progress: false | |
| env: | |
| IMAGE: ghcr.io/${{ github.repository }} | |
| jobs: | |
| gate: | |
| name: gate | |
| # The same fmt/clippy/build/test/deny gate pull requests must pass. | |
| # The image is not pushed or signed without it — see gates.yml. | |
| uses: ./.github/workflows/gates.yml | |
| image: | |
| name: build & push (ghcr) | |
| needs: [gate] | |
| runs-on: ubuntu-24.04 # was ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write # push the image to GHCR | |
| id-token: write # cosign keyless OIDC + provenance OIDC | |
| attestations: write # record SLSA build provenance for the image digest | |
| # arm64 compiles under QEMU emulation, so the build is slow; give it room. | |
| timeout-minutes: 90 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up QEMU (arm64 emulation) | |
| uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Derive image tags and labels | |
| id: meta | |
| uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 | |
| with: | |
| images: ${{ env.IMAGE }} | |
| tags: | | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| # `latest=auto` tags only the highest non-prerelease semver as | |
| # `latest`, mirroring release.yml's prerelease handling. | |
| flavor: | | |
| latest=auto | |
| - name: Build and push (linux/amd64, linux/arm64) | |
| id: build | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| context: . | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| provenance: mode=max | |
| sbom: true | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| with: | |
| cosign-release: 'v2.4.3' | |
| - name: Sign image by digest (sigstore keyless OIDC) | |
| env: | |
| COSIGN_YES: 'true' | |
| DIGEST: ${{ steps.build.outputs.digest }} | |
| # Sign the multi-arch manifest digest once; the signature covers every | |
| # tag that points at it. Verify with the recipe in the README. | |
| run: cosign sign --yes "${IMAGE}@${DIGEST}" | |
| - name: Attest build provenance (image digest) | |
| # GitHub-issued SLSA provenance for the manifest digest, pushed to | |
| # GHCR alongside the image and verifiable with | |
| # `gh attestation verify oci://<image>@<digest> --repo no42-org/onmsctl`. | |
| # Separate from the buildx `provenance: mode=max` above: that is | |
| # BuildKit's own attestation baked into the image; this is a | |
| # GitHub attestation the `gh` CLI understands. | |
| uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 | |
| with: | |
| subject-name: ${{ env.IMAGE }} | |
| subject-digest: ${{ steps.build.outputs.digest }} | |
| push-to-registry: true |