Revert "Update publish-docker.yml" #103
Conversation
WalkthroughThe pull request modifies the GitHub Actions workflow for Docker image publication, focusing on enhancing image attestation processes. The workflow now includes separate attestation steps for DockerHub and GitHub Container Registry (GHCR), with updated configurations that add more precise image provenance tracking. The changes introduce a new step for GHCR attestation and refine the existing DockerHub attestation step by adding specific digest and name parameters. Changes
Sequence DiagramsequenceDiagram
participant Workflow
participant Docker Build
participant DockerHub
participant GHCR
Workflow->>Docker Build: Build and Push Image
Docker Build-->>Workflow: Image Digest
Workflow->>DockerHub: Attest DockerHub Image
Workflow->>GHCR: Attest GHCR Image
Possibly related PRs
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/publish-docker.yml (1)
86-91: GHCR attestation configuration looks secure but could be improvedThe attestation step is properly configured, mirroring the DockerHub configuration with appropriate registry changes.
Consider using environment variables for registry URLs to maintain consistency:
- subject-name: ghcr.io/${{ github.repository_owner }}/${{ vars.IMAGE_NAME }} + subject-name: ${{ vars.GHCR_REGISTRY }}/${{ github.repository_owner }}/${{ vars.IMAGE_NAME }}
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/publish-docker.yml(1 hunks)
🔇 Additional comments (1)
.github/workflows/publish-docker.yml (1)
79-84: DockerHub attestation configuration looks secure
The attestation step is properly configured with:
- Official GitHub action
- Correct digest reference
- Proper registry path construction
Verify the permissions are properly set:
✅ Verification successful
DockerHub attestation configuration and permissions are correctly set
The workflow has all the required permissions properly configured for secure attestation:
id-token: writefor OIDC token generationattestations: writefor publishing attestationscontents: readfor accessing repositorypackages: writefor publishing artifacts
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Check if required permissions for attestation are properly set
# Check for required permissions in the workflow
rg -A 5 'permissions:' .github/workflows/publish-docker.yml
Length of output: 211
Reverts #102
Summary by CodeRabbit
New Features
Improvements