Generate build provenance attestation

artyom · Nov 23, 2024 · 3de10af · 3de10af
1 parent aeebb0c
commit 3de10af
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -23,6 +23,7 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ github.token }}
       - uses: docker/build-push-action@v6
+        id: push
         with:
           push: true
           platforms: |
@@ -33,3 +34,8 @@ jobs:
           outputs: type=image,oci-mediatypes=true,compression=zstd,compression-level=6,force-compression=true
           cache-from: type=gha
           cache-to: type=gha,mode=max
+      - uses: actions/attest-build-provenance@v1
+        with:
+          subject-name: ghcr.io/${{ github.repository }}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true