Skip to content

UID2-7041: promote OCI tag only after attest+verify pass #231

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BehnamMozafari merged 5 commits into from
May 14, 2026
+30 −6
Merged

UID2-7041: promote OCI tag only after attest+verify pass #231

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
94526ed
UID2-7041: push by digest, promote tag only after attest
BehnamMozafari May 13, 2026
125ddbd
UID2-7041: promote tag after attest in Java publish workflow
BehnamMozafari May 13, 2026
47843b8
UID2-7041: TEMP smoke harness for tag-after-verify (delete after capt…
BehnamMozafari May 13, 2026
09c250c
UID2-7041: smoke trigger on push for first run
BehnamMozafari May 13, 2026
b05c09b
UID2-7041: drop smoke harness; runs 25783580596 (green) + 25783628840…
BehnamMozafari May 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 15 additions & 3 deletions .github/workflows/shared-publish-java-to-docker-versioned.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -209,14 +209,13 @@ jobs:
image_ref: ${{ steps.extractImageTag.outputs.firstTag }}
scan_type: image

- name: Push to Docker
- name: Push to Docker (by digest, untagged)
id: push
uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
with:
context: ${{inputs.working_dir}}
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}${{ inputs.append_image_name }},push-by-digest=true,push=true
build-args: |
JAR_VERSION=${{ steps.version.outputs.new_version }}
IMAGE_VERSION=${{ steps.version.outputs.new_version }}
Expand All @@ -228,6 +227,19 @@ jobs:
subject_name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}${{ inputs.append_image_name }}
subject_digest: ${{ steps.push.outputs.digest }}

- name: Promote digest to consumable tag(s)
shell: bash
env:
DIGEST: ${{ steps.push.outputs.digest }}
TAGS: ${{ steps.meta.outputs.tags }}
SOURCE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}${{ inputs.append_image_name }}
run: |
set -euo pipefail
while IFS= read -r tag; do
[[ -z "$tag" ]] && continue
docker buildx imagetools create -t "$tag" "${SOURCE}@${DIGEST}"
done <<< "$TAGS"

- name: Create Release
uses: IABTechLab/uid2-shared-actions/actions/shared_create_releases@v3
with:
Expand Down
18 changes: 15 additions & 3 deletions actions/shared_publish_to_docker/action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,15 +92,14 @@ runs:
image_ref: ${{ steps.extractImageTag.outputs.firstTag }}
scan_type: ${{ inputs.scan_type }}

- name: Push to Docker
- name: Push to Docker (by digest, untagged)
id: push
uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
with:
context: ${{ inputs.docker_context }}
file: ${{ inputs.docker_file }}
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
outputs: type=image,name=${{ inputs.docker_registry }}/${{ inputs.docker_image_name }},push-by-digest=true,push=true
build-args: |
JAR_VERSION=${{ inputs.new_version }}
IMAGE_VERSION=${{ inputs.new_version }}
Expand All @@ -111,3 +110,16 @@ runs:
with:
subject_name: ${{ inputs.docker_registry }}/${{ inputs.docker_image_name }}
subject_digest: ${{ steps.push.outputs.digest }}

- name: Promote digest to consumable tag(s)
shell: bash
env:
DIGEST: ${{ steps.push.outputs.digest }}
TAGS: ${{ steps.meta.outputs.tags }}
SOURCE: ${{ inputs.docker_registry }}/${{ inputs.docker_image_name }}
run: |
set -euo pipefail
while IFS= read -r tag; do
[[ -z "$tag" ]] && continue
docker buildx imagetools create -t "$tag" "${SOURCE}@${DIGEST}"
done <<< "$TAGS"
Loading