Skip to content

Merge pull request #196 from nirmata/dependabot/github_actions/action… #116

Merge pull request #196 from nirmata/dependabot/github_actions/action…

Merge pull request #196 from nirmata/dependabot/github_actions/action… #116

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: Publish images
permissions: {}
on:
push:
branches:
- "main"
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
publish-images:
runs-on: ubuntu-latest
permissions:
packages: write
id-token: write
outputs:
image-digest: ${{ steps.publish-kyverno-notation-aws.outputs.digest }}
steps:
- name: Checkout
uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
- name: Setup build env
uses: ./.github/actions/setup-build-env
with:
build-cache-key: publish-images
- name: Login to Docker Hub
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Run Trivy vulnerability scanner in repo mode
uses: aquasecurity/trivy-action@d710430a6722f083d3b36b8339ff66b32f22ee55 # v0.19.0
with:
scan-type: "fs"
ignore-unfixed: true
format: "sarif"
output: "trivy-results.sarif"
severity: "CRITICAL,HIGH"
- name: Install Cosign
uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
- name: Publish image
id: publish-kyverno-notation-aws
uses: ./.github/actions/publish-image
with:
makefile-target: docker-publish
registry: ghcr.io
registry-username: ${{ github.actor }}
registry-password: ${{ secrets.GITHUB_TOKEN }}
repository: ${{ github.repository_owner }}
version: ${{ github.ref_name }}
sign-image: true
sbom-name: kyverno-notation-aws
sbom-repository: ghcr.io/${{ github.repository }}/sbom
signature-repository: ghcr.io/${{ github.repository }}/signatures
main-path: ./
image-tag: latest
generate-kyverno-notation-aws-provenance:
needs: publish-images
permissions:
id-token: write # To sign the provenance.
packages: write # To upload assets to release.
actions: read # To read the workflow path.
# NOTE: The container generator workflow is not officially released as GA.
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
with:
image: ghcr.io/${{ github.repository_owner }}/kyverno-notation-aws
digest: "${{ needs.publish-images.outputs.image-digest }}"
registry-username: ${{ github.actor }}
secrets:
registry-password: ${{ secrets.GITHUB_TOKEN }}