Skip to content

Commit 858b0d9

Browse files
guguclaude
gugu
and
claude
authored
feat: add SLSA provenance and attestations to all Docker build workflows (#1670)
* feat: add SLSA provenance and attestations to all Docker build workflows Enable provenance: true and sbom: true on all image builds, upgrade attest-build-provenance to v2, and add merged manifest attestation for multi-platform bake workflows. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: compute merged manifest digest from raw bytes instead of Go template The --format '{{.Manifest.Digest}}' template doesn't work for OCI image indexes. Use --raw | sha256sum to reliably compute the digest. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: remove setup-qemu-action from build workflows QEMU is unnecessary since all platform builds run on native runners. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 1ac9111 commit 858b0d9

5 files changed

Lines changed: 83 additions & 10 deletions

File tree

‎.github/workflows/build-agent.yml‎

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -67,9 +67,6 @@ jobs:
6767
name: bake-meta
6868
path: /tmp
6969

70-
- name: Set up QEMU
71-
uses: docker/setup-qemu-action@v3
72-
7370
- name: Set up Docker Buildx
7471
uses: docker/setup-buildx-action@v3
7572

@@ -84,6 +81,7 @@ jobs:
8481
uses: docker/bake-action@v5
8582
with:
8683
sbom: true
84+
provenance: true
8785
files: |
8886
./docker-bake-agent.hcl
8987
/tmp/bake-meta.json
@@ -108,14 +106,18 @@ jobs:
108106
retention-days: 1
109107

110108
- name: Attest Build Provenance
111-
uses: actions/attest-build-provenance@v1
109+
uses: actions/attest-build-provenance@v2
112110
with:
113111
subject-digest: "${{ fromJSON(steps.bake.outputs.metadata).image['containerimage.digest'] }}"
114112
push-to-registry: false
115113
subject-name: ${{ env.REGISTRY_IMAGE }}
116114

117115
merge:
118116
runs-on: ubuntu-latest
117+
permissions:
118+
id-token: write
119+
contents: read
120+
attestations: write
119121
needs:
120122
- build
121123
steps:
@@ -147,6 +149,20 @@ jobs:
147149
docker buildx imagetools create $(jq -cr '.target."docker-metadata-action".tags | map(select(startswith("${{ env.REGISTRY_IMAGE }}")) | "-t " + .) | join(" ")' /tmp/bake-meta.json) \
148150
$(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
149151
152+
- name: Get merged manifest digest
153+
id: manifest
154+
run: |
155+
TAG=$(jq -r '.target."docker-metadata-action".args.DOCKER_META_VERSION' /tmp/bake-meta.json)
156+
DIGEST="sha256:$(docker buildx imagetools inspect "${{ env.REGISTRY_IMAGE }}:${TAG}" --raw | sha256sum | cut -d ' ' -f1)"
157+
echo "digest=${DIGEST}" >> $GITHUB_OUTPUT
158+
159+
- name: Attest Merged Manifest Provenance
160+
uses: actions/attest-build-provenance@v2
161+
with:
162+
subject-digest: ${{ steps.manifest.outputs.digest }}
163+
subject-name: ${{ env.REGISTRY_IMAGE }}
164+
push-to-registry: false
165+
150166
- name: Inspect image
151167
run: |
152168
docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:$(jq -r '.target."docker-metadata-action".args.DOCKER_META_VERSION' /tmp/bake-meta.json)

‎.github/workflows/build.yml‎

Lines changed: 21 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -68,9 +68,6 @@ jobs:
6868
name: bake-meta
6969
path: /tmp
7070

71-
- name: Set up QEMU
72-
uses: docker/setup-qemu-action@v3
73-
7471
- name: Set up Docker Buildx
7572
uses: docker/setup-buildx-action@v3
7673

@@ -85,6 +82,7 @@ jobs:
8582
uses: docker/bake-action@v5
8683
with:
8784
sbom: true
85+
provenance: true
8886
files: |
8987
./docker-bake.hcl
9088
/tmp/bake-meta.json
@@ -109,14 +107,18 @@ jobs:
109107
retention-days: 1
110108

111109
- name: Attest Build Provenance
112-
uses: actions/attest-build-provenance@v1
110+
uses: actions/attest-build-provenance@v2
113111
with:
114112
subject-digest: "${{ fromJSON(steps.bake.outputs.metadata).image['containerimage.digest'] }}"
115113
push-to-registry: false
116-
subject-name: ${{ env.REGISTRY_IMAGE }}
114+
subject-name: ${{ env.REGISTRY_IMAGE }}
117115

118116
merge:
119117
runs-on: ubuntu-latest
118+
permissions:
119+
id-token: write
120+
contents: read
121+
attestations: write
120122
needs:
121123
- build
122124
steps:
@@ -148,6 +150,20 @@ jobs:
148150
docker buildx imagetools create $(jq -cr '.target."docker-metadata-action".tags | map(select(startswith("${{ env.REGISTRY_IMAGE }}")) | "-t " + .) | join(" ")' /tmp/bake-meta.json) \
149151
$(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
150152
153+
- name: Get merged manifest digest
154+
id: manifest
155+
run: |
156+
TAG=$(jq -r '.target."docker-metadata-action".args.DOCKER_META_VERSION' /tmp/bake-meta.json)
157+
DIGEST="sha256:$(docker buildx imagetools inspect "${{ env.REGISTRY_IMAGE }}:${TAG}" --raw | sha256sum | cut -d ' ' -f1)"
158+
echo "digest=${DIGEST}" >> $GITHUB_OUTPUT
159+
160+
- name: Attest Merged Manifest Provenance
161+
uses: actions/attest-build-provenance@v2
162+
with:
163+
subject-digest: ${{ steps.manifest.outputs.digest }}
164+
subject-name: ${{ env.REGISTRY_IMAGE }}
165+
push-to-registry: false
166+
151167
- name: Inspect image
152168
run: |
153169
docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:$(jq -r '.target."docker-metadata-action".args.DOCKER_META_VERSION' /tmp/bake-meta.json)

‎.github/workflows/quay.yml‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,7 @@ jobs:
9292
uses: docker/bake-action@v5
9393
with:
9494
sbom: true
95+
provenance: true
9596
files: |
9697
./docker-bake.hcl
9798
/tmp/bake-meta.json
@@ -116,14 +117,18 @@ jobs:
116117
retention-days: 1
117118

118119
- name: Attest Build Provenance
119-
uses: actions/attest-build-provenance@v1
120+
uses: actions/attest-build-provenance@v2
120121
with:
121122
subject-digest: "${{ fromJSON(steps.bake.outputs.metadata).image['containerimage.digest'] }}"
122123
push-to-registry: false
123124
subject-name: ${{ env.REGISTRY_IMAGE }}
124125

125126
merge:
126127
runs-on: ubuntu-latest
128+
permissions:
129+
id-token: write
130+
contents: read
131+
attestations: write
127132
needs:
128133
- build
129134
steps:
@@ -156,6 +161,20 @@ jobs:
156161
docker buildx imagetools create $(jq -cr '.target."docker-metadata-action".tags | map(select(startswith("${{ env.REGISTRY_IMAGE }}")) | "-t " + .) | join(" ")' /tmp/bake-meta.json) \
157162
$(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
158163
164+
- name: Get merged manifest digest
165+
id: manifest
166+
run: |
167+
TAG=$(jq -r '.target."docker-metadata-action".args.DOCKER_META_VERSION' /tmp/bake-meta.json)
168+
DIGEST="sha256:$(docker buildx imagetools inspect "${{ env.REGISTRY_IMAGE }}:${TAG}" --raw | sha256sum | cut -d ' ' -f1)"
169+
echo "digest=${DIGEST}" >> $GITHUB_OUTPUT
170+
171+
- name: Attest Merged Manifest Provenance
172+
uses: actions/attest-build-provenance@v2
173+
with:
174+
subject-digest: ${{ steps.manifest.outputs.digest }}
175+
subject-name: ${{ env.REGISTRY_IMAGE }}
176+
push-to-registry: false
177+
159178
- name: Inspect image
160179
run: |
161180
docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:$(jq -r '.target."docker-metadata-action".args.DOCKER_META_VERSION' /tmp/bake-meta.json)

‎.github/workflows/saas.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ jobs:
2727
permissions:
2828
contents: read
2929
packages: write
30+
attestations: write
3031
# This is used to complete the identity challenge
3132
# with sigstore/fulcio when running outside of PRs.
3233
id-token: write
@@ -92,6 +93,16 @@ jobs:
9293
labels: ${{ steps.meta.outputs.labels }}
9394
cache-from: type=gha
9495
cache-to: type=gha,mode=max
96+
sbom: true
97+
provenance: true
98+
99+
- name: Attest Build Provenance
100+
if: ${{ github.event_name != 'pull_request' }}
101+
uses: actions/attest-build-provenance@v2
102+
with:
103+
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
104+
subject-digest: ${{ steps.build-and-push.outputs.digest }}
105+
push-to-registry: true
95106

96107
# Sign the resulting Docker image digest except on PRs.
97108
# This will only write to the public Rekor transparency log when the Docker

‎.github/workflows/ws-server.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ jobs:
2727
permissions:
2828
contents: read
2929
packages: write
30+
attestations: write
3031
# This is used to complete the identity challenge
3132
# with sigstore/fulcio when running outside of PRs.
3233
id-token: write
@@ -80,6 +81,16 @@ jobs:
8081
labels: ${{ steps.meta.outputs.labels }}
8182
cache-from: type=gha
8283
cache-to: type=gha,mode=max
84+
sbom: true
85+
provenance: true
86+
87+
- name: Attest Build Provenance
88+
if: ${{ github.event_name != 'pull_request' }}
89+
uses: actions/attest-build-provenance@v2
90+
with:
91+
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
92+
subject-digest: ${{ steps.build-and-push.outputs.digest }}
93+
push-to-registry: true
8394

8495
# Sign the resulting Docker image digest except on PRs.
8596
# This will only write to the public Rekor transparency log when the Docker

0 commit comments

Comments
 (0)