Skip to content

Commit ecc6e68

Browse files
mchmarnymchmarny
committed
chore: refactor to maximize re-use
1 parent f5fc0a7 commit ecc6e68

File tree

3 files changed

+89
-100
lines changed

3 files changed

+89
-100
lines changed

‎.github/actions/publish-container/action.yml‎

Lines changed: 5 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -74,41 +74,9 @@ runs:
7474
mv /tmp/.buildx-cache-new /tmp/.buildx-cache
7575
fi
7676
77-
- name: Attest
78-
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
79-
id: attest
77+
- name: Generate SBOM and Attest
78+
uses: ./.github/actions/sbom-and-attest
8079
with:
81-
subject-name: ${{ steps.image.outputs.name }}
82-
subject-digest: ${{ steps.image.outputs.digest }}
83-
push-to-registry: true
84-
85-
- name: Derive safe filename
86-
id: name
87-
shell: bash
88-
run: |
89-
IMAGE="${{ steps.image.outputs.name }}"
90-
SAFE="$(basename "${IMAGE%%:*}")" # strip tag if present, then basename
91-
echo "safe=$SAFE" >> "$GITHUB_OUTPUT"
92-
93-
- name: Generate SBOM
94-
uses: anchore/sbom-action@8e94d75ddd33f69f691467e42275782e4bfefe84 # v0.20.9
95-
with:
96-
image: ${{ steps.image.outputs.name }}@${{ steps.image.outputs.digest }}
97-
format: cyclonedx-json
98-
output-file: sbom-${{ steps.name.outputs.safe }}.cdx.json
99-
upload-artifact: true # also uploads to the workflow run
100-
upload-release-assets: auto # 'auto' == assets on tags
101-
102-
- name: Install Cosign
103-
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
104-
105-
- name: Cosign SBOM attestation
106-
shell: bash
107-
env:
108-
COSIGN_EXPERIMENTAL: "1"
109-
run: |
110-
cosign attest \
111-
--yes \
112-
--predicate sbom-${{ steps.name.outputs.safe }}.cdx.json \
113-
--type cyclonedx \
114-
${{ steps.image.outputs.name }}@${{ steps.image.outputs.digest }}
80+
image_name: ${{ steps.image.outputs.name }}
81+
image_digest: ${{ steps.image.outputs.digest }}
82+
registry_password: ${{ inputs.registry_password }}

‎.github/actions/sbom-and-attest/action.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# Copyright (c) 2025, NVIDIA CORPORATION. All rights reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
name: 'Generate SBOM and Attest'
16+
description: 'Generates SBOM and build provenance attestation for container images'
17+
18+
inputs:
19+
image_name:
20+
description: 'Full image name (without tag or digest)'
21+
required: true
22+
image_digest:
23+
description: 'Image digest (sha256:...)'
24+
required: true
25+
registry_password:
26+
description: 'Registry password for authentication'
27+
required: true
28+
29+
runs:
30+
using: 'composite'
31+
steps:
32+
- name: Authenticate to GHCR
33+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
34+
with:
35+
registry: ghcr.io
36+
username: ${{ github.actor }}
37+
password: ${{ inputs.registry_password }}
38+
39+
- name: Derive safe filename
40+
id: name
41+
shell: bash
42+
run: |
43+
IMAGE="${{ inputs.image_name }}"
44+
SAFE="$(basename "${IMAGE%%:*}")" # strip tag if present, then basename
45+
echo "safe=$SAFE" >> "$GITHUB_OUTPUT"
46+
47+
- name: Generate SBOM
48+
uses: anchore/sbom-action@8e94d75ddd33f69f691467e42275782e4bfefe84 # v0.20.9
49+
with:
50+
image: "${{ inputs.image_name }}@${{ inputs.image_digest }}"
51+
format: cyclonedx-json
52+
output-file: sbom-${{ steps.name.outputs.safe }}.cdx.json
53+
upload-artifact: true # also uploads to the workflow run
54+
upload-release-assets: auto # 'auto' == assets on tags
55+
56+
- name: Install Cosign
57+
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
58+
59+
- name: Cosign SBOM attestation
60+
shell: bash
61+
run: |
62+
cosign attest \
63+
--yes \
64+
--predicate sbom-${{ steps.name.outputs.safe }}.cdx.json \
65+
--type cyclonedx \
66+
"${{ inputs.image_name }}@${{ inputs.image_digest }}"
67+
68+
- name: Attest build provenance
69+
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
70+
with:
71+
subject-name: ${{ inputs.image_name }}
72+
subject-digest: ${{ inputs.image_digest }}
73+
push-to-registry: true

‎.github/workflows/publish.yml‎

Lines changed: 11 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -189,80 +189,29 @@ jobs:
189189
VERSION: ${{ steps.ref-name.outputs.value }}
190190
run: scripts/buildko.sh
191191

192-
attest:
192+
attest-and-sbom-ko:
193193
needs: build-images-ko
194194
runs-on: linux-amd64-cpu32
195195
permissions:
196+
contents: read
196197
packages: write
197198
id-token: write
198199
attestations: write
199200
strategy:
200201
matrix:
201202
image: ${{ fromJson(needs.build-images-ko.outputs.images) }}
202203
steps:
203-
- name: Authenticate to GHCR
204-
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
205-
with:
206-
registry: ghcr.io
207-
username: ${{ github.actor }}
208-
password: ${{ secrets.GITHUB_TOKEN }}
209-
210-
- name: Attest build provenance
211-
id: attest
212-
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
213-
with:
214-
subject-name: ${{ matrix.image.name }}
215-
subject-digest: ${{ matrix.image.digest }}
216-
push-to-registry: true
217-
218-
sbom-ko:
219-
needs: build-images-ko
220-
runs-on: linux-amd64-cpu32
221-
permissions:
222-
contents: read
223-
id-token: write # required for Cosign keyless signing
224-
packages: write # needed to push attestations to GHCR
225-
security-events: write # only needed if you also upload SARIF somewhere
226-
strategy:
227-
matrix:
228-
image: ${{ fromJson(needs.build-images-ko.outputs.images) }}
229-
steps:
230-
- name: Authenticate to GHCR
231-
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
204+
- name: Checkout Code
205+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
232206
with:
233-
registry: ghcr.io
234-
username: ${{ github.actor }}
235-
password: ${{ secrets.GITHUB_TOKEN }}
236-
237-
- name: Derive safe filename
238-
id: name
239-
shell: bash
240-
run: |
241-
IMAGE="${{ matrix.image.name }}"
242-
SAFE="$(basename "${IMAGE%%:*}")" # strip tag if present, then basename
243-
echo "safe=$SAFE" >> "$GITHUB_OUTPUT"
207+
ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || github.ref }}
244208

245-
- name: Generate SBOM
246-
uses: anchore/sbom-action@8e94d75ddd33f69f691467e42275782e4bfefe84 # v0.20.9
209+
- name: Generate SBOM and Attest
210+
uses: ./.github/actions/sbom-and-attest
247211
with:
248-
image: "${{ matrix.image.name }}@${{ matrix.image.digest }}"
249-
format: cyclonedx-json
250-
output-file: sbom-${{ steps.name.outputs.safe }}.cdx.json
251-
upload-artifact: true # also uploads to the workflow run
252-
upload-release-assets: auto # 'auto' == assets on tags
253-
254-
- name: Install Cosign
255-
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
256-
257-
- name: Cosign SBOM attestation
258-
env:
259-
COSIGN_EXPERIMENTAL: "1"
260-
run: |
261-
cosign attest \
262-
--yes \
263-
--predicate sbom-${{ steps.name.outputs.safe }}.cdx.json \
264-
--type cyclonedx \
265-
"${{ matrix.image.name }}@${{ matrix.image.digest }}"
212+
image_name: ${{ matrix.image.name }}
213+
image_digest: ${{ matrix.image.digest }}
214+
registry_password: ${{ secrets.GITHUB_TOKEN }}
266215

267216
e2e-test:
268217
name: "E2E Test Published Images"
@@ -271,8 +220,7 @@ jobs:
271220
needs:
272221
- build-images-docker
273222
- build-images-ko
274-
- attest
275-
- sbom-ko
223+
- attest-and-sbom-ko
276224
env:
277225
CLUSTER_NAME: 'nvsentinel-uat'
278226
FAKE_GPU_NODE_COUNT: '10'

0 commit comments

Comments
 (0)