Skip to content

Commit 4d8e6e7

Browse files
johnsimonsjohnsimons
committed
Improving provenance of image
Using native action to login to ghcr.io Replaced multiple tagging commands with a single one Using build-push-action instead of script This adds the provenance by default, see https://docs.docker.com/build/ci/github-actions/attestations/#default-provenance This given the image a better score in DockerHub scout health score
1 parent 87cae8b commit 4d8e6e7

File tree

7 files changed

+89
-60
lines changed

7 files changed

+89
-60
lines changed

‎.github/workflows/build-containers.yml‎

Lines changed: 21 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,10 @@ jobs:
1212
include:
1313
- name: servicecontrol
1414
project: ServiceControl
15-
description: ServiceControl error instance
1615
- name: servicecontrol-audit
1716
project: ServiceControl.Audit
18-
description: ServiceControl audit instance
1917
- name: servicecontrol-monitoring
2018
project: ServiceControl.Monitoring
21-
description: ServiceControl monitoring instance
2219
fail-fast: false
2320
steps:
2421
- name: Check for secrets
@@ -38,26 +35,25 @@ jobs:
3835
with:
3936
version: ${{ env.MinVerVersion }}
4037
- name: Set up Docker Buildx
41-
uses: docker/setup-buildx-action@v3.9.0
38+
uses: docker/setup-buildx-action@v3
4239
- name: Log in to GitHub container registry
43-
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
44-
- name: Build & inspect image
45-
env:
46-
TAG_NAME: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || env.MinVerVersion }}
47-
run: |
48-
docker buildx build --push --tag ghcr.io/particular/${{ matrix.name }}:${{ env.TAG_NAME }} \
49-
--file src/${{ matrix.project }}/Dockerfile \
50-
--build-arg VERSION=${{ env.MinVerVersion }} \
51-
--annotation "index:org.opencontainers.image.title=${{ matrix.name }}" \
52-
--annotation "index:org.opencontainers.image.description=${{ matrix.description }}" \
53-
--annotation "index:org.opencontainers.image.created=$(date '+%FT%TZ')" \
54-
--annotation "index:org.opencontainers.image.revision=${{ github.sha }}" \
55-
--annotation "index:org.opencontainers.image.authors=Particular Software" \
56-
--annotation "index:org.opencontainers.image.vendor=Particular Software" \
57-
--annotation "index:org.opencontainers.image.version=${{ env.MinVerVersion }}" \
58-
--annotation "index:org.opencontainers.image.source=https://github.com/${{ github.repository }}/tree/${{ github.sha }}" \
59-
--annotation "index:org.opencontainers.image.url=https://hub.docker.com/r/particular/${{ matrix.name }}" \
60-
--annotation "index:org.opencontainers.image.documentation=https://docs.particular.net/servicecontrol/" \
61-
--annotation "index:org.opencontainers.image.base.name=mcr.microsoft.com/dotnet/aspnet:8.0-jammy-chiseled-composite-extra" \
62-
--platform linux/arm64,linux/amd64 .
63-
docker buildx imagetools inspect ghcr.io/particular/${{ matrix.name }}:${{ env.TAG_NAME }}
40+
uses: docker/login-action@v3
41+
with:
42+
registry: ghcr.io
43+
username: ${{ github.actor }}
44+
password: ${{ secrets.GITHUB_TOKEN }}
45+
- name: Get current date
46+
id: date
47+
run: echo "date=$(date '+%FT%TZ')" >> $GITHUB_OUTPUT
48+
- name: Build and push image to GitHub container registry
49+
uses: docker/build-push-action@v6
50+
with:
51+
push: true
52+
platforms: linux/amd64,linux/arm64
53+
sbom: true
54+
build-args: |
55+
VERSION=${{ env.MinVerVersion }}
56+
SHA=${{ github.sha }}
57+
CREATED=${{ steps.date.outputs.date }}
58+
file: src/${{ matrix.project }}/Dockerfile
59+
tags: ghcr.io/particular/${{ matrix.name }}:${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || env.MinVerVersion }}

‎.github/workflows/build-db-container.yml‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,14 @@ jobs:
2424
uses: ./.github/actions/validate-version
2525
with:
2626
version: ${{ env.MinVerVersion }}
27+
- name: Set up Docker Buildx
28+
uses: docker/setup-buildx-action@v3
2729
- name: Log in to GitHub container registry
28-
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
30+
uses: docker/login-action@v3
31+
with:
32+
registry: ghcr.io
33+
username: ${{ github.actor }}
34+
password: ${{ secrets.GITHUB_TOKEN }}
2935
- name: Install Docker arm64 emulation
3036
run: docker run --privileged --rm tonistiigi/binfmt --install arm64
3137
- name: Build images

‎.github/workflows/container-integration-test.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,9 +56,13 @@ jobs:
5656
- name: Run MinVer
5757
uses: Particular/[email protected]
5858
- name: Log in to GitHub container registry
59-
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
59+
uses: docker/login-action@v3
60+
with:
61+
registry: ghcr.io
62+
username: ${{ github.actor }}
63+
password: ${{ secrets.GITHUB_TOKEN }}
6064
- name: Log in to Docker Hub
61-
uses: docker/login-action@v3.3.0
65+
uses: docker/login-action@v3
6266
with:
6367
username: ${{ secrets.DOCKERHUB_USERNAME }}
6468
password: ${{ secrets.DOCKERHUB_TOKEN }}

‎.github/workflows/push-container-images.yml‎

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -22,28 +22,32 @@ jobs:
2222
with:
2323
version: ${{ inputs.version }}
2424
- name: Log in to GitHub container registry
25-
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
25+
uses: docker/login-action@v3
26+
with:
27+
registry: ghcr.io
28+
username: ${{ github.actor }}
29+
password: ${{ secrets.GITHUB_TOKEN }}
2630
- name: Login to Docker Hub
27-
uses: docker/login-action@v3.3.0
31+
uses: docker/login-action@v3
2832
with:
2933
username: ${{ secrets.DOCKERHUB_USERNAME }}
3034
password: ${{ secrets.DOCKERHUB_TOKEN }}
35+
- name: Set up Docker Buildx
36+
uses: docker/setup-buildx-action@v3
3137
- name: Publish to Docker Hub
3238
run: |
3339
$containers = @('servicecontrol', 'servicecontrol-audit', 'servicecontrol-monitoring', 'servicecontrol-ravendb')
3440
$tags = "${{ steps.validate.outputs.container-tags }}" -Split ','
3541
$sourceTag = "${{ inputs.version }}"
3642
37-
foreach ($tag in $tags)
43+
foreach($name in $containers)
3844
{
39-
foreach($name in $containers)
40-
{
41-
Write-Output "::group::Pushing $($name):$($tag)"
42-
$cmd = "docker buildx imagetools create --tag particular/$($name):$($tag) ghcr.io/particular/$($name):$($sourceTag)"
43-
Write-Output "Command: $cmd"
44-
Invoke-Expression $cmd
45-
Write-Output "::endgroup::"
46-
}
45+
Write-Output "::group::Pushing $name with $tags tags"
46+
$tagsCLI = $tags -replace "^", "--tag particular/${name}:"
47+
$cmd = "docker buildx imagetools create $tagsCLI ghcr.io/particular/${name}:$sourceTag"
48+
Write-Output "Command: $cmd"
49+
Invoke-Expression $cmd
50+
Write-Output "::endgroup::"
4751
}
4852
- name: Update Docker Hub Description - ServiceControl
4953
if: ${{ steps.validate.outputs.latest == 'true' }}

‎src/ServiceControl.Audit/Dockerfile‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -11,15 +11,21 @@ RUN dotnet publish src/HealthCheckApp/HealthCheckApp.csproj --arch $TARGETARCH -
1111
# Runtime image
1212
FROM mcr.microsoft.com/dotnet/aspnet:8.0-jammy-chiseled-composite-extra
1313
ARG VERSION
14+
ARG SHA=unknown
15+
ARG CREATED=2000-01-01T00:00:00Z
1416
WORKDIR /app
1517

16-
LABEL org.opencontainers.image.source=https://github.com/Particular/ServiceControl \
17-
org.opencontainers.image.authors="Particular Software" \
18-
org.opencontainers.image.url=https://docs.particular.net/servicecontrol/ \
19-
org.opencontainers.image.documentation=https://docs.particular.net/servicecontrol/ \
20-
org.opencontainers.image.version=$VERSION \
21-
org.opencontainers.image.title=ServiceControl.Audit \
22-
org.opencontainers.image.description="ServiceControl audit instance"
18+
LABEL org.opencontainers.image.source=https://github.com/Particular/ServiceControl/tree/$SHA
19+
LABEL org.opencontainers.image.authors="Particular Software"
20+
LABEL org.opencontainers.image.vendor="Particular Software"
21+
LABEL org.opencontainers.image.url=https://hub.docker.com/r/particular/servicecontrol-audit
22+
LABEL org.opencontainers.image.documentation=https://docs.particular.net/servicecontrol/
23+
LABEL org.opencontainers.image.version=$VERSION
24+
LABEL org.opencontainers.image.revision=$SHA
25+
LABEL org.opencontainers.image.created=$CREATED
26+
LABEL org.opencontainers.image.title="ServiceControl Audit Instance"
27+
LABEL org.opencontainers.image.description="Provide valuable information about the message flow through a system."
28+
LABEL org.opencontainers.image.base.name=mcr.microsoft.com/dotnet/aspnet:8.0-jammy-chiseled-composite-extra
2329

2430
EXPOSE 44444
2531

‎src/ServiceControl.Monitoring/Dockerfile‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -11,15 +11,21 @@ RUN dotnet publish src/HealthCheckApp/HealthCheckApp.csproj --arch $TARGETARCH -
1111
# Runtime image
1212
FROM mcr.microsoft.com/dotnet/aspnet:8.0-jammy-chiseled-composite-extra
1313
ARG VERSION
14+
ARG SHA=unknown
15+
ARG CREATED=2000-01-01T00:00:00Z
1416
WORKDIR /app
1517

16-
LABEL org.opencontainers.image.source=https://github.com/Particular/ServiceControl \
17-
org.opencontainers.image.authors="Particular Software" \
18-
org.opencontainers.image.url=https://docs.particular.net/servicecontrol/ \
19-
org.opencontainers.image.documentation=https://docs.particular.net/servicecontrol/ \
20-
org.opencontainers.image.version=$VERSION \
21-
org.opencontainers.image.title=ServiceControl.Monitoring \
22-
org.opencontainers.image.description="ServiceControl monitoring instance"
18+
LABEL org.opencontainers.image.source=https://github.com/Particular/ServiceControl/tree/$SHA
19+
LABEL org.opencontainers.image.authors="Particular Software"
20+
LABEL org.opencontainers.image.vendor="Particular Software"
21+
LABEL org.opencontainers.image.url=https://hub.docker.com/r/particular/servicecontrol-monitoring
22+
LABEL org.opencontainers.image.documentation=https://docs.particular.net/servicecontrol/
23+
LABEL org.opencontainers.image.version=$VERSION
24+
LABEL org.opencontainers.image.revision=$SHA
25+
LABEL org.opencontainers.image.created=$CREATED
26+
LABEL org.opencontainers.image.title="ServiceControl Monitoring Instance"
27+
LABEL org.opencontainers.image.description="Track the health of a distributed system."
28+
LABEL org.opencontainers.image.base.name=mcr.microsoft.com/dotnet/aspnet:8.0-jammy-chiseled-composite-extra
2329

2430
EXPOSE 33633
2531

‎src/ServiceControl/Dockerfile‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -11,15 +11,22 @@ RUN dotnet publish src/HealthCheckApp/HealthCheckApp.csproj --arch $TARGETARCH -
1111
# Runtime image
1212
FROM mcr.microsoft.com/dotnet/aspnet:8.0-jammy-chiseled-composite-extra
1313
ARG VERSION
14+
ARG SHA=unknown
15+
ARG CREATED=2000-01-01T00:00:00Z
1416
WORKDIR /app
1517

16-
LABEL org.opencontainers.image.source=https://github.com/Particular/ServiceControl \
17-
org.opencontainers.image.authors="Particular Software" \
18-
org.opencontainers.image.url=https://docs.particular.net/servicecontrol/ \
19-
org.opencontainers.image.documentation=https://docs.particular.net/servicecontrol/ \
20-
org.opencontainers.image.version=$VERSION \
21-
org.opencontainers.image.title=ServiceControl \
22-
org.opencontainers.image.description="ServiceControl primary instance"
18+
LABEL org.opencontainers.image.source=https://github.com/Particular/ServiceControl/tree/$SHA
19+
LABEL org.opencontainers.image.authors="Particular Software"
20+
LABEL org.opencontainers.image.vendor="Particular Software"
21+
LABEL org.opencontainers.image.url=https://hub.docker.com/r/particular/servicecontrol
22+
LABEL org.opencontainers.image.documentation=https://docs.particular.net/servicecontrol/
23+
LABEL org.opencontainers.image.version=$VERSION
24+
LABEL org.opencontainers.image.revision=$SHA
25+
LABEL org.opencontainers.image.created=$CREATED
26+
LABEL org.opencontainers.image.title="ServiceControl"
27+
LABEL org.opencontainers.image.description="Gather status, performance and monitoring data for multiple endpoints from a single location."
28+
LABEL org.opencontainers.image.base.name=mcr.microsoft.com/dotnet/aspnet:8.0-jammy-chiseled-composite-extra
29+
2330

2431
EXPOSE 33333
2532

0 commit comments

Comments
 (0)