Add image publish action#16
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| id: meta | ||
| working-directory: ${{ env.CONTAINERFILE_DIR }} | ||
| run: | | ||
| REPO_NAME=${{ github.event.repository.name }} |
Check failure
Code scanning / zizmor
code injection via template expansion Error
| run: | | ||
| IFS=',' read -ra TAGS <<< '${{ steps.meta.outputs.tags }}' | ||
| for tag in "${TAGS[@]}"; do | ||
| pullstring="${tag}@${{ steps.push.outputs.digest }}" |
Check notice
Code scanning / zizmor
code injection via template expansion Note
| if: github.event_name != 'pull_request' | ||
| shell: bash | ||
| run: | | ||
| IFS=',' read -ra TAGS <<< '${{ steps.meta.outputs.tags }}' |
Check notice
Code scanning / zizmor
code injection via template expansion Note
| if [[ "${{ github.event_name }}" == "pull_request" ]]; then | ||
| TAGS="${FULL_IMAGE_NAME,,}:pr-${{ github.event.number }}" | ||
| else | ||
| TAGS="${FULL_IMAGE_NAME,,}:${{ github.sha }},${FULL_IMAGE_NAME,,}:latest" |
Check notice
Code scanning / zizmor
code injection via template expansion Note
| echo "full-image-name=${FULL_IMAGE_NAME,,}" >> $GITHUB_OUTPUT | ||
|
|
||
| if [[ "${{ github.event_name }}" == "pull_request" ]]; then | ||
| TAGS="${FULL_IMAGE_NAME,,}:pr-${{ github.event.number }}" |
Check notice
Code scanning / zizmor
code injection via template expansion Note
| uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0 | ||
|
|
||
| - name: checkout repository | ||
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 |
Check warning
Code scanning / zizmor
detects commit SHAs that don't match their version comment tags Warning
|
|
||
| steps: | ||
| - name: harden runner | ||
| uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 |
Check warning
Code scanning / zizmor
action has a known vulnerability Warning
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| packages: write |
Check warning
Code scanning / zizmor
permissions without explanatory comments Warning
| if: github.event_name != 'pull_request' | ||
| shell: bash | ||
| run: | | ||
| IFS=',' read -ra TAGS <<< '${{ steps.meta.outputs.tags }}' |
Check notice
Code scanning / zizmor
code injection via template expansion Note
| run: | | ||
| IFS=',' read -ra TAGS <<< '${{ steps.meta.outputs.tags }}' | ||
| for tag in "${TAGS[@]}"; do | ||
| pullstring="${tag}@${{ steps.push.outputs.digest }}" |
Check notice
Code scanning / zizmor
code injection via template expansion Note
2 participants
Build plugin in OCI image, and publish + cosign image on (manual) release event.