fix attest

cyberworm-uk · Oct 8, 2024 · d463bd5 · d463bd5
1 parent 3c5a74e
commit d463bd5
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 2 deletions.
diff --git a/.github/workflows/docker-publish-arti.yml b/.github/workflows/docker-publish-arti.yml
@@ -9,7 +9,12 @@ env:
   REGISTRY: ghcr.io
 
 jobs:
-  ghcr_publish:
+  publish:
+    permissions:
+      id-token: write
+      packages: write
+      contents: read
+      attestations: write
     runs-on: ubuntu-latest
     steps:
       - name: checkout
@@ -30,10 +35,19 @@ jobs:
 
       - name: Build and push arti
         uses: docker/build-push-action@v6
+        id: push
         env:
           SOURCE_DATE_EPOCH: 0
         with:
           context: arti/
           platforms: linux/amd64,linux/arm64
           push: true
-          tags: ${{ env.REGISTRY }}/${{ github.actor }}/arti:latest
+          tags: ${{ env.REGISTRY }}/${{ github.actor }}/arti:latest
+
+      - name: Attest
+        uses: actions/attest-build-provenance@v1
+        id: attest
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ github.actor }}/arti
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
@@ -11,6 +11,11 @@ env:
 
 jobs:
   publish:
+    permissions:
+      id-token: write
+      packages: write
+      contents: read
+      attestations: write
     runs-on: ubuntu-latest
     steps:
       - name: checkout