wip: don't generate provenance attestation

https://stackoverflow.com/a/77207574
govuk-one-login · Aug 15, 2024 · c87c8c9 · c87c8c9
1 parent 8a549ea
commit c87c8c9
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/action.yaml b/action.yaml
@@ -138,6 +138,7 @@ runs:
         labels: ${{ steps.docker_meta.outputs.labels }}
         tags: ${{ steps.docker_meta.outputs.tags }}
         platforms: ${{ inputs.docker-platform }}
+        provenance: false # needed because ECR displays image manifests in a confusing way - should we expose this as an input to the action?
         cache-from: ${{ env.CACHE_IMAGE && format('type=registry,ref={0}', env.CACHE_IMAGE) || '' }}
         cache-to: ${{ env.CACHE_IMAGE && format('mode=max,image-manifest=true,oci-mediatypes=true,type=registry,ref={0}', env.CACHE_IMAGE) || '' }}