From 3d8b5b200bd1e4b7f7cbfc01609f5f7f85a333de Mon Sep 17 00:00:00 2001 From: Andrei Jiroh Halili Date: Sat, 3 Aug 2024 02:14:24 +0800 Subject: [PATCH] ci(github-actions): :green_heart: spread attestation chores across registries Also in this commit, I re-arranged image labels for mkdocs-material in the Dockerfile itself. Signed-off-by: Andrei Jiroh Halili --- .github/workflows/docker-buildops.yml | 82 +++++++++++++++------------ docker/mkdocs-material/Dockerfile | 7 ++- 2 files changed, 50 insertions(+), 39 deletions(-) diff --git a/.github/workflows/docker-buildops.yml b/.github/workflows/docker-buildops.yml index 4ad0589..dd725b2 100644 --- a/.github/workflows/docker-buildops.yml +++ b/.github/workflows/docker-buildops.yml @@ -3,6 +3,7 @@ name: Docker Image Builds on: schedule: - cron: '30 */12 * * *' + workflow_dispatch: push: paths: - docker/** @@ -84,14 +85,6 @@ jobs: registry: dock.mau.dev username: ${{ steps.dotenvx.outputs.GLCR_MAUDEV_BOT_USERNAME }} password: ${{ steps.dotenvx.outputs.GLCR_MAUDEV_BOT_PASSWORD }} - - # Install the cosign tool except on PR - # https://github.com/sigstore/cosign-installer - - name: Install cosign - if: github.event_name != 'pull_request' - uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0 - with: - cosign-release: 'v2.2.4' # Extract metadata (tags, labels) for Docker # https://github.com/docker/metadata-action @@ -115,7 +108,7 @@ jobs: # https://github.com/docker/build-push-action - name: Build and push Docker image id: build - uses: docker/build-push-action@v6.1.1 + uses: docker/build-push-action@v6 with: context: docker/mkdocs-material #file: Dockerfile @@ -124,17 +117,29 @@ jobs: #load: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} - - name: Generate image attestation + pull: true + - name: Generate image attestation for GHCR uses: actions/attest-build-provenance@v1 - if: ${{ github.event_name == 'push' }} - continue-on-error: true - id: attest with: - subject-path: | - ghcr.io/${{ env.IMAGE_NAME_PREFIX }}/mkdocs-material - dock.mau.dev/${{ env.IMAGE_NAME_PREFIX }}/mkdocs-material - quay.io/andreijiroh-dev/mkdocs-material - index.docker.io/ajhalili2006/mkdocs-material + subject-path: ghcr.io/${{ env.IMAGE_NAME_PREFIX }}/mkdocs-material + subject-digest: ${{ steps.build.outputs.digest }} + push-to-registry: true + - name: Generate image attestation for GitLab Container Registry + uses: actions/attest-build-provenance@v1 + with: + subject-path: dock.mau.dev/${{ env.IMAGE_NAME_PREFIX }}/mkdocs-material + subject-digest: ${{ steps.build.outputs.digest }} + push-to-registry: true + - name: Generate image attestation for RHQCR + uses: actions/attest-build-provenance@v1 + with: + subject-path: quay.io/andreijiroh-dev/mkdocs-material + subject-digest: ${{ steps.build.outputs.digest }} + push-to-registry: true + - name: Generate image attestation for Docker Hub + uses: actions/attest-build-provenance@v1 + with: + subject-path: index.docker.io/ajhalili2006/mkdocs-material subject-digest: ${{ steps.build.outputs.digest }} push-to-registry: true pkgops-alpine: @@ -187,14 +192,6 @@ jobs: registry: dock.mau.dev username: ${{ steps.dotenvx.outputs.GLCR_MAUDEV_BOT_USERNAME }} password: ${{ steps.dotenvx.outputs.GLCR_MAUDEV_BOT_PASSWORD }} - - # Install the cosign tool except on PR - # https://github.com/sigstore/cosign-installer - - name: Install cosign - if: github.event_name != 'pull_request' - uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0 - with: - cosign-release: 'v2.2.4' - name: Extract Docker metadata id: meta @@ -220,17 +217,28 @@ jobs: push: ${{ github.event_name != 'pull_request' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} - - - name: Generate image attestation + pull: true + - name: Generate image attestation for GHCR uses: actions/attest-build-provenance@v1 - if: ${{ github.event_name == 'push' }} - id: attest - continue-on-error: true with: - subject-path: | - ghcr.io/${{ env.IMAGE_NAME_PREFIX }}/pkgops-alpine - dock.mau.dev/${{ env.IMAGE_NAME_PREFIX }}/pkgops-alpine - quay.io/andreijiroh-dev/pkgops-alpine - index.docker.io/ajhalili2006/pkgops-alpine + subject-path: ghcr.io/${{ env.IMAGE_NAME_PREFIX }}/pkgops-alpine + subject-digest: ${{ steps.build.outputs.digest }} + push-to-registry: true + - name: Generate image attestation for GitLab Container Registry + uses: actions/attest-build-provenance@v1 + with: + subject-path: dock.mau.dev/${{ env.IMAGE_NAME_PREFIX }}/pkgops-alpine + subject-digest: ${{ steps.build.outputs.digest }} + push-to-registry: true + - name: Generate image attestation for RHQCR + uses: actions/attest-build-provenance@v1 + with: + subject-path: quay.io/andreijiroh-dev/pkgops-alpine + subject-digest: ${{ steps.build.outputs.digest }} + push-to-registry: true + - name: Generate image attestation for Docker Hub + uses: actions/attest-build-provenance@v1 + with: + subject-path: index.docker.io/ajhalili2006/pkgsops-alpine subject-digest: ${{ steps.build.outputs.digest }} - push-to-registry: true \ No newline at end of file + push-to-registry: true diff --git a/docker/mkdocs-material/Dockerfile b/docker/mkdocs-material/Dockerfile index b105d8c..518abbc 100644 --- a/docker/mkdocs-material/Dockerfile +++ b/docker/mkdocs-material/Dockerfile @@ -9,8 +9,11 @@ LABEL org.opencontainers.image.description="GitLab CI image for a custom mkdocs- org.opencontainers.image.vendor="Andrei Jiroh Halili" \ org.opencontainers.image.url="https://go.andreijiroh.xyz/mkdocs-material" \ org.opencontainers.image.documentation="https://github.com/andreijiroh-dev/docker-images/blob/main/docker/mkdocs-material/README.md" \ - dev.recaptime.opensource.stabilityLevel="unstable" dev.recaptime.opensource.maintainer="ajhalili2006" \ - dev.recaptime.opensource.license="MPL-2.0" dev.recaptime.opensource.repoOwnerType="staff-verified-public" org.opencontainers.image.license="MPL-2.0" + org.opencontainers.image.license="MPL-2.0" +LABEL dev.recaptime.opensource.stabilityLevel="unstable" \ + dev.recaptime.opensource.maintainer="ajhalili2006" \ + dev.recaptime.opensource.license="MPL-2.0" \ + dev.recaptime.opensource.repoOwnerType="staff-verified-public" # Since hadolint isn't in the package repos for Alpine yet, we'll copying from the offical -- 2.51.2