Skip to content

Commit 1bd6048

Browse files
johnsimonsjohnsimons
committed
Improving provenance of image
Using native action to login to ghcr.io Replaced multiple tagging commands with a single one Using build-push-action instead of script This adds the provenance by default, see https://docs.docker.com/build/ci/github-actions/attestations/#default-provenance This given the image a better score in DockerHub scout health score
1 parent 00c1e5a commit 1bd6048

File tree

3 files changed

+48
-45
lines changed

3 files changed

+48
-45
lines changed

‎.github/workflows/push-container-images.yml‎

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -22,29 +22,28 @@ jobs:
2222
with:
2323
version: ${{ inputs.version }}
2424
- name: Log in to GitHub container registry
25-
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
25+
uses: docker/login-action@v3
26+
with:
27+
registry: ghcr.io
28+
username: ${{ github.actor }}
29+
password: ${{ secrets.GITHUB_TOKEN }}
2630
- name: Login to Docker Hub
27-
uses: docker/login-action@v3.3.0
31+
uses: docker/login-action@v3
2832
with:
2933
username: ${{ secrets.DOCKERHUB_USERNAME }}
3034
password: ${{ secrets.DOCKERHUB_TOKEN }}
35+
- name: Set up Docker Buildx
36+
uses: docker/setup-buildx-action@v3
3137
- name: Publish to Docker Hub
3238
run: |
33-
$containers = @('servicepulse')
3439
$tags = "${{ steps.validate.outputs.container-tags }}" -Split ','
3540
$sourceTag = "${{ inputs.version }}"
3641
37-
foreach ($tag in $tags)
38-
{
39-
foreach($name in $containers)
40-
{
41-
Write-Output "::group::Pushing $($name):$($tag)"
42-
$cmd = "docker buildx imagetools create --tag particular/$($name):$($tag) ghcr.io/particular/$($name):$($sourceTag)"
43-
Write-Output "Command: $cmd"
44-
Invoke-Expression $cmd
45-
Write-Output "::endgroup::"
46-
}
47-
}
42+
$tagsCLI = $tags -replace "^", "--tag particular/servicepulse:"
43+
44+
$cmd = "docker buildx imagetools create $tagsCLI ghcr.io/particular/servicepulse:$sourceTag"
45+
Write-Output "Command: $cmd"
46+
Invoke-Expression $cmd
4847
- name: Update Docker Hub Description
4948
if: ${{ steps.validate.outputs.latest == 'true' }}
5049
uses: peter-evans/[email protected]

‎.github/workflows/release.yml‎

Lines changed: 22 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -140,28 +140,26 @@ jobs:
140140
with:
141141
version: ${{ env.MinVerVersion }}
142142
- name: Set up Docker Buildx
143-
uses: docker/setup-buildx-action@v3.7.1
143+
uses: docker/setup-buildx-action@v3
144144
- name: Log in to GitHub container registry
145-
shell: bash
146-
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
147-
- name: Build & inspect image
148-
env:
149-
TAG_NAME: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || env.MinVerVersion }}
150-
shell: bash
151-
run: |
152-
docker buildx build --push --tag ghcr.io/particular/servicepulse:${{ env.TAG_NAME }} \
153-
--file src/ServicePulse/Dockerfile \
154-
--build-arg VERSION=${{ env.MinVerVersion }} \
155-
--annotation "index:org.opencontainers.image.title=ServicePulse" \
156-
--annotation "index:org.opencontainers.image.description=ServicePulse provides real-time production monitoring for distributed applications. It monitors the health of a system's endpoints, detects processing errors, sends failed messages for reprocessing, and ensures the specific environment's needs are met, all in one consolidated dashboard." \
157-
--annotation "index:org.opencontainers.image.created=$(date '+%FT%TZ')" \
158-
--annotation "index:org.opencontainers.image.revision=${{ github.sha }}" \
159-
--annotation "index:org.opencontainers.image.authors=Particular Software" \
160-
--annotation "index:org.opencontainers.image.vendor=Particular Software" \
161-
--annotation "index:org.opencontainers.image.version=${{ env.MinVerVersion }}" \
162-
--annotation "index:org.opencontainers.image.source=https://github.com/${{ github.repository }}/tree/${{ github.sha }}" \
163-
--annotation "index:org.opencontainers.image.url=https://hub.docker.com/r/particular/servicepulse" \
164-
--annotation "index:org.opencontainers.image.documentation=https://docs.particular.net/servicepulse/" \
165-
--annotation "index:org.opencontainers.image.base.name=mcr.microsoft.com/dotnet/aspnet:8.0-noble-chiseled-composite" \
166-
--platform linux/arm64,linux/amd64 .
167-
docker buildx imagetools inspect ghcr.io/particular/servicepulse:${{ env.TAG_NAME }}
145+
uses: docker/login-action@v3
146+
with:
147+
registry: ghcr.io
148+
username: ${{ github.actor }}
149+
password: ${{ secrets.GITHUB_TOKEN }}
150+
- name: Get current date
151+
id: date
152+
run: echo "date=$(date '+%FT%TZ')" >> $GITHUB_OUTPUT
153+
- name: Build and push image to GitHub container registry
154+
uses: docker/build-push-action@v6
155+
with:
156+
push: true
157+
platforms: linux/amd64,linux/arm64
158+
sbom: true
159+
build-args: |
160+
VERSION=${{ env.MinVerVersion }}
161+
SHA=${{ github.sha }}
162+
CREATED=${{ steps.date.outputs.date }}
163+
file: src/ServicePulse/Dockerfile
164+
tags: ghcr.io/particular/servicepulse:${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || env.MinVerVersion }}
165+

‎src/ServicePulse/Dockerfile‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,15 +17,21 @@ RUN dotnet publish src/ServicePulse/ServicePulse.csproj -a $TARGETARCH -o /app
1717
# Host runtime image
1818
FROM mcr.microsoft.com/dotnet/aspnet:8.0-noble-chiseled-composite
1919
ARG VERSION
20+
ARG SHA=unknown
21+
ARG CREATED=2000-01-01T00:00:00Z
2022
WORKDIR /app
2123

22-
LABEL org.opencontainers.image.source="https://github.com/particular/servicepulse" \
23-
org.opencontainers.image.authors="Particular Software" \
24-
org.opencontainers.image.url=https://docs.particular.net/servicepulse/ \
25-
org.opencontainers.image.documentation="https://docs.particular.net/servicepulse/" \
26-
org.opencontainers.image.version=$VERSION \
27-
org.opencontainers.image.title="ServicePulse" \
28-
org.opencontainers.image.description="ServicePulse provides real-time production monitoring for distributed applications. It monitors the health of a system's endpoints, detects processing errors, sends failed messages for reprocessing, and ensures the specific environment's needs are met, all in one consolidated dashboard."
24+
LABEL org.opencontainers.image.source=https://github.com/Particular/servicepulse/tree/$SHA
25+
LABEL org.opencontainers.image.authors="Particular Software"
26+
LABEL org.opencontainers.image.vendor="Particular Software"
27+
LABEL org.opencontainers.image.url=https://hub.docker.com/r/particular/servicepulse
28+
LABEL org.opencontainers.image.documentation=https://docs.particular.net/servicepulse/
29+
LABEL org.opencontainers.image.version=$VERSION
30+
LABEL org.opencontainers.image.revision=$SHA
31+
LABEL org.opencontainers.image.created=$CREATED
32+
LABEL org.opencontainers.image.title="ServicePulse"
33+
LABEL org.opencontainers.image.description="ServicePulse provides real-time production monitoring for distributed applications. It monitors the health of a system's endpoints, detects processing errors, sends failed messages for reprocessing, and ensures the specific environment's needs are met, all in one consolidated dashboard."
34+
LABEL org.opencontainers.image.base.name=mcr.microsoft.com/dotnet/aspnet:8.0-noble-chiseled-composite
2935

3036
ENV ASPNETCORE_HTTP_PORTS=9090
3137
EXPOSE 9090

0 commit comments

Comments
 (0)