Oppdate GH actions - submitt salsa i eget steg.

.github/workflows/deploy.yaml

@@ -13,34 +13,57 @@ jobs:
   build:
     name: Build and publish Docker image
     runs-on: ubuntu-latest
+    permissions: # Sjekk https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
+      contents: "write" # For å submitte dependency graph
+      checks: "write"
+      pull-requests: "write"
+      id-token: "write"
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-java@v4
         with:
           distribution: temurin
           java-version: 21
-      - uses: gradle/wrapper-validation[email protected]
-      - uses: gradle/[email protected]
+      - uses: gradle/actions/wrapper-validation@v4
+      - uses: gradle/actions/setup-gradle@v4
         env:
           # Eksluder test dependencies
           DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS: compileClasspath|runtimeClasspath
         with:
-          gradle-version: wrapper
           dependency-graph: generate-and-submit
-          arguments: --configuration-cache build
+          cache-encryption-key: ${{ secrets.GradleEncryptionKey }}
+      - run: ./gradlew --configuration-cache build
+
 
       - name: docker-build-push
         uses: nais/docker-build-push@v0
         id: docker-build-push
         with:
           team: teamdagpenger
+          push_image: true # optional, default true
           tag: ${{ github.sha }}
           dockerfile: mediator/Dockerfile # optional, default Dockerfile
           docker_context: mediator # optional, default .
           identity_provider: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}
           project_id: ${{ vars.NAIS_MANAGEMENT_PROJECT_ID }}
+          salsa: false
     outputs:
       image: ${{ steps.docker-build-push.outputs.image }}
+      digest: ${{ steps.docker-build-push.outputs.digest }}
+
+  salsa:
+    name: Generate SBOM, attest and sign image
+    needs: [ build ]
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: "write"
+    steps:
+      - uses: navikt/dagpenger/actions/attest-sign@master
+        with:
+          digest: ${{ needs.build.outputs.digest }}
+          identity_provider: ${{ secrets.NAIS_WORKLOAD_IDENTITY_PROVIDER }}
+          project_id: ${{ vars.NAIS_MANAGEMENT_PROJECT_ID }}
+          team: teamdagpenger
 
   deploy-dev:
     name: Deploy to dev