Added attestation on Docker images (masesgroup#538)

masesdevelopers · Sep 19, 2024 · 5d304e2 · 5d304e2
1 parent 45a2d05
commit 5d304e2
Show file tree

Hide file tree

Showing 4 changed files with 39 additions and 4 deletions.
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
@@ -66,6 +66,11 @@ jobs:
     needs: check_changes
     if: "always() && needs.check_changes.outputs.run_build_windows == 'true'"
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      packages: write
+      contents: read
+      attestations: write
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:    
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
@@ -119,6 +124,7 @@ jobs:
             ghcr.io/${{ github.repository_owner }}/jnet
 
       - name: Build and push
+        id: push
         uses: docker/build-push-action@v6
         with:
           file: ./src/container/Dockerfile.linux
@@ -129,7 +135,15 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           provenance: true
           sbom: true
-
+
+      - name: Attest Docker Hub
+        uses: actions/attest-build-provenance@v1
+        id: attest
+        with:
+          subject-name: index.docker.io/masesgroup/jnet
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true
+
   # Now run "build_windows"
   build_windows:
     needs: check_changes

diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
@@ -13,6 +13,11 @@ on:
 jobs:
   build_container_linux:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      packages: write
+      contents: read
+      attestations: write
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:    
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
@@ -73,6 +78,7 @@ jobs:
             ghcr.io/${{ github.repository_owner }}/jnet
 
       - name: Build and push
+        id: push
         uses: docker/build-push-action@v6
         with:
           file: ./src/container/Dockerfile.linux
@@ -83,4 +89,19 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           provenance: true
           sbom: true
-
+
+      - name: Attest Docker Hub
+        uses: actions/attest-build-provenance@v1
+        id: attest1
+        with:
+          subject-name: index.docker.io/masesgroup/jnet
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true
+
+      - name: Attest GitHub
+        uses: actions/attest-build-provenance@v1
+        id: attest2
+        with:
+          subject-name: ghcr.io/${{ github.repository_owner }}/jnet
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true
diff --git a/tests/net/JNetWPFTest/JNetWPFTest.csproj b/tests/net/JNetWPFTest/JNetWPFTest.csproj
@@ -7,7 +7,7 @@
 		<RootNamespace>MASES.JNetWPFTest</RootNamespace>
 		<Title>JNetWPFTest - a test tool for JNet</Title>
 		<Description>JNetWPFTest - a test tool for JNet</Description>
-		<TargetFrameworks>net462;net6.0-windows;net7.0-windows</TargetFrameworks>
+		<TargetFrameworks>net462;net6.0-windows;net8.0-windows</TargetFrameworks>
 	</PropertyGroup>
 	<ItemGroup>
 		<None Include="..\Common\app.manifest">

diff --git a/tests/net/JNetWinFormsTest/JNetWinFormsTest.csproj b/tests/net/JNetWinFormsTest/JNetWinFormsTest.csproj
@@ -8,7 +8,7 @@
 		<RootNamespace>MASES.JNetWinFormsTest</RootNamespace>
 		<Title>JNetWinFormsTest - a test tool for JNet</Title>
 		<Description>JNetWinFormsTest - a test tool for JNet</Description>
-		<TargetFrameworks>net462;net6.0-windows;net7.0-windows</TargetFrameworks>
+		<TargetFrameworks>net462;net6.0-windows;net8.0-windows</TargetFrameworks>
 		<DefineConstants>$(DefineConstants);WINFORMS</DefineConstants>
 	</PropertyGroup>
 	<ItemGroup>