🌱 publish docker images to GitHub Container Registry

[spencerschrock]

The goal is to use GHCR to replace Google Container Registry (GCR) for future Scorecard Action releases to reduce network egress costs. These workflows will build two types of images:

1. Release images, which are tagged following a v1.2.3 pattern. These container images will be retained indefinitely.
2. Per-commit images for each push to main. These images are used when testing the action, and will be removed after a week.

The workflow was primarily based on GitHub's example workflow. You can see this working in my fork:

• A normal push to main, generating a latest image, with no attestation workflow
• A tagged image, generating a release image, with an attestation. workflow
• The cleanup workflow, deleting untagged images on schedule, or on dispatch.

[raghavkaul]

What is the network egress cost and why does it not apply with GHCR?

[spencerschrock]

What is the network egress cost

When someone runs the action, it pulls our gcr.io image, which has pricing associated with it

General network usage applies for any data read from your Cloud Storage bucket that does not fall into one of the above categories or the Always Free usage limits. For example, general network usage applies when data moves from a Cloud Storage bucket to the Internet.

Monthly Usage	Data transfer to Worldwide Destinations (excluding Asia & Australia)(per GB)	Data transfer to Asia Destinations (excluding China, but including Hong Kong)(per GB)	Data transfer to China Destinations (excluding Hong Kong)(per GB)	Data transfer to Australia Destinations and Data transfer from Cloud Storage regions located in Australia(per GB)	Inbound data transfer
0-1 TB	$0.12	$0.12	$0.23	$0.19	Free
1-10 TB	$0.11	$0.11	$0.22	$0.18	Free
10+ TB	$0.08	$0.08	$0.20	$0.15	Free

why does it not apply with GHCR?

GHCR is free for public packages. And also has a section later on about GitHub Actions

All data transferred out, when triggered by GitHub Actions, and data transferred in from any source is free. We determine you are downloading packages using GitHub Actions when you log in to GitHub Packages using a GITHUB_TOKEN.