add google artifact registry test

Signed-off-by: Brian DeHamer <bdehamer@github.com>
bdehamer · May 14, 2024 · 15cd5e4 · 15cd5e4
1 parent 6c73918
commit 15cd5e4
Showing 1 changed file with 47 additions and 0 deletions.
diff --git a/.github/workflows/oci-google.yml b/.github/workflows/oci-google.yml
@@ -0,0 +1,47 @@
+name: Attest Image (Google Artifact Registry)
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build-image-dockerhub:
+    name: Build & Attest
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      attestations: write
+    env:
+      REGISTRY: us-west1-docker.pkg.dev
+      IMAGE_NAME: dehamer24/bdehamer/attest-demo
+    steps:
+      - name: Build artifact
+        run: date > artifact.bin
+      - name: Build Dockerfile
+        run: |
+          cat <<EOF > Dockerfile
+          FROM scratch
+          COPY artifact.bin .
+          EOF
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: _json_key
+          password: ${{ secrets.GOOGLE_JSON_KEY }}
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@v5.0.0
+        with:
+          context: .
+          push: true
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+      - name: Attest artifact
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true