Merge branch 'develop'

Signed-off-by: Pedro Lamas <[email protected]>

Author: pedrolamas

.github/workflows/build.yml

@@ -57,6 +57,11 @@ jobs:
     needs: build
     if: ${{ github.event_name != 'pull_request' }}
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+      attestations: write
+      packages: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -94,19 +99,31 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        id: docker_push
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile
           platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/ppc64le,linux/s390x
           push: true
+          sbom: true
+          provenance: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
           tags: ${{ steps.docker_meta.outputs.tags }}
           labels: ${{ steps.docker_meta.outputs.labels }}
 
+      - name: Attest Docker image
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-name: ghcr.io/${{ github.repository }}
+          subject-digest: ${{ steps.docker_push.outputs.digest }}
+          push-to-registry: true
+
   publish-web:
     name: Deploy to Host
     needs: build
-    if: ${{ github.ref == 'refs/heads/develop' }}
+    if: ${{ github.repository == 'fluidd-core/fluidd' && github.ref == 'refs/heads/develop' }}
     runs-on: ubuntu-latest
     permissions:
       id-token: write

.github/workflows/release.yml

@@ -50,7 +50,7 @@ jobs:
           echo "current_version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
 
       - name: Read ChangeLog
-        uses: mindsers/[email protected].0
+        uses: mindsers/[email protected].3
         id: changelog
         with:
           validation_depth: 1
@@ -88,7 +88,7 @@ jobs:
           path: ./dist
 
       - name: Publish Release
-        uses: eregon/publish-release@v1
+        uses: eregon/publish-release@v1.0.6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -97,6 +97,7 @@ jobs:
   publish-web:
     name: Deploy to Host
     needs: build
+    if: ${{ github.repository == 'fluidd-core/fluidd' }}
     runs-on: ubuntu-latest
     permissions:
       id-token: write