7878 echo "digest=$(echo "$output" | jq -r '.manifest.digest // .manifests[0].digest')" >> "$GITHUB_OUTPUT"
7979 env :
8080 GH_REPO : ${{ github.repository }}
81- - name : Upload provenance to release
82- run : |
83- set -Eeuo pipefail
84- FORMATTED_DIGEST=${DIGEST//:/_}
85- gh attestation verify --repo "${GH_REPO}" "oci://${REGISTRY}/${GH_REPO}-${CONTAINER_FLAVOR}@${DIGEST}" --format json --jq '.[] | .attestation.bundle.dsseEnvelope | select(.payloadType == "application/vnd.in-toto+json").payload' | base64 -d | jq . > "${REPOSITORY_OWNER}-${REPOSITORY_NAME}-${CONTAINER_FLAVOR}_${FORMATTED_DIGEST}.intoto.jsonl"
86- gh release upload "${REF_NAME}" ./*.intoto.jsonl
87- env :
88- DIGEST : ${{ steps.inspect-manifest.outputs.digest }}
89- GH_REPO : ${{ github.repository }}
90- GH_TOKEN : ${{ github.token }}
91- REPOSITORY_OWNER : ${{ github.repository_owner }}
92- REPOSITORY_NAME : ${{ github.event.repository.name }}
9381 - name : Update package details in release
9482 run : |
9583 set -Eeuo pipefail
@@ -102,30 +90,6 @@ jobs:
10290 GH_REPO : ${{ github.repository }}
10391 GH_TOKEN : ${{ github.token }}
10492
105- publish-devcontainer-templates :
106- name : 📝 Publish templates
107- runs-on : ubuntu-latest
108- permissions :
109- packages : write # is needed by devcontainers/action to write templates as OCI artifacts
110- steps :
111- - uses : step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
112- with :
113- disable-sudo : true
114- egress-policy : audit
115- - uses : actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
116- with :
117- persist-credentials : false
118- - uses : docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
119- with :
120- registry : ghcr.io
121- username : ${{ github.actor }}
122- password : ${{ github.token }}
123- - uses : devcontainers/action@1082abd5d2bf3a11abccba70eef98df068277772 # v1.4.3
124- with :
125- disable-repo-tagging : true
126- publish-templates : true
127- base-path-to-templates : .devcontainer
128-
12993 upload-binaries :
13094 name : 📄 Upload Binaries
13195 runs-on : ubuntu-latest
0 commit comments