[actions] Generate artifact attestation

drassi-run · Sep 23, 2024 · 7b140ca · 7b140ca
1 parent c32a694
commit 7b140ca
Showing 1 changed file with 10 additions and 2 deletions.
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
@@ -43,8 +43,8 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract Docker metadata
-        id: meta
         uses: docker/metadata-action@v5
+        id: meta
         env:
           DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
         with:
@@ -66,8 +66,8 @@ jobs:
           docker buildx inspect
 
       - name: Build and push Docker image
-        id: publish
         uses: docker/build-push-action@v6
+        id: publish
         with:
           pull: true
           push: true
@@ -82,3 +82,11 @@ jobs:
           platforms: |
             linux/amd64
             linux/arm64
+
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v1
+        id: attest
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.publish.outputs.digest }}
+          push-to-registry: true