chore: use commit sha as a tag

Author: mchmarny

.github/actions/publish-container/action.yml

@@ -81,3 +81,34 @@ runs:
         subject-name: ${{ steps.image.outputs.name }}
         subject-digest: ${{ steps.image.outputs.digest }}
         push-to-registry: true
+
+    - name: Derive safe filename
+      id: name
+      shell: bash
+      run: |
+        IMAGE="${{ steps.image.outputs.name  }}"
+        SAFE="$(basename "${IMAGE%%:*}")"  # strip tag if present, then basename
+        echo "safe=$SAFE" >> "$GITHUB_OUTPUT"
+
+    - name: Generate SBOM
+      uses: anchore/sbom-action@8e94d75ddd33f69f691467e42275782e4bfefe84  # v0.20.9
+      with:
+        image: ${{ steps.image.outputs.name  }}@${{ steps.image.outputs.digest }}
+        format: cyclonedx-json
+        output-file: sbom-${{ steps.name.outputs.safe }}.cdx.json
+        upload-artifact: true          # also uploads to the workflow run
+        upload-release-assets: auto    # 'auto' == assets on tags
+
+    - name: Install Cosign
+      uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad  # v4.0.0
+
+    - name: Cosign SBOM attestation
+      shell: bash
+      env:
+        COSIGN_EXPERIMENTAL: "1"
+      run: |
+        cosign attest \
+          --yes \
+          --predicate sbom-${{ steps.name.outputs.safe }}.cdx.json \
+          --type cyclonedx \
+          ${{ steps.image.outputs.name  }}@${{ steps.image.outputs.digest }}

.github/workflows/publish.yml

@@ -71,7 +71,7 @@ jobs:
             echo "value=${{ github.ref_name }}" >> $GITHUB_OUTPUT
           else
             SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
-            echo "value=${{ github.ref_name }}-${SHORT_SHA}" >> $GITHUB_OUTPUT
+            echo "value=${SHORT_SHA}" >> $GITHUB_OUTPUT
           fi
 
       - name: Build image list
@@ -90,7 +90,7 @@ jobs:
           path: versions.txt
           retention-days: 90
 
-  container-publish:
+  build-images-docker:
     runs-on: linux-amd64-cpu32
     timeout-minutes: 60
     strategy:
@@ -130,7 +130,7 @@ jobs:
             echo "value=${{ github.ref_name }}" >> $GITHUB_OUTPUT
           else
             SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
-            echo "value=${{ github.ref_name }}-${SHORT_SHA}" >> $GITHUB_OUTPUT
+            echo "value=${SHORT_SHA}" >> $GITHUB_OUTPUT
           fi
 
       - name: Publish container for ${{ matrix.component }}
@@ -144,7 +144,7 @@ jobs:
           tag_suffix: ${{ matrix.tag_suffix }}
 
   # Build images using ko and attest provenance
-  build-images:
+  build-images-ko:
     runs-on: linux-amd64-cpu32
     timeout-minutes: 60
     permissions:
@@ -175,7 +175,7 @@ jobs:
             echo "value=${{ github.ref_name }}" >> $GITHUB_OUTPUT
           else
             SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
-            echo "value=${{ github.ref_name }}-${SHORT_SHA}" >> $GITHUB_OUTPUT
+            echo "value=${SHORT_SHA}" >> $GITHUB_OUTPUT
           fi
 
       # ko is already installed in the setup-ci-env action
@@ -190,15 +190,15 @@ jobs:
         run: scripts/buildko.sh
 
   attest:
-    needs: build-images
+    needs: build-images-ko
     runs-on: linux-amd64-cpu32
     permissions:
       packages: write
       id-token: write
       attestations: write
     strategy:
       matrix:
-        image: ${{ fromJson(needs.build-images.outputs.images) }}
+        image: ${{ fromJson(needs.build-images-ko.outputs.images) }}
     steps:
       - name: Authenticate to GHCR
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef  # v3.6.0
@@ -216,7 +216,7 @@ jobs:
           push-to-registry: true
 
   sbom-ko:
-    needs: build-images
+    needs: build-images-ko
     runs-on: linux-amd64-cpu32
     permissions:
       contents: read
@@ -225,7 +225,7 @@ jobs:
       security-events: write  # only needed if you also upload SARIF somewhere
     strategy:
       matrix:
-        image: ${{ fromJson(needs.build-images.outputs.images) }}
+        image: ${{ fromJson(needs.build-images-ko.outputs.images) }}
     steps:
       - name: Authenticate to GHCR
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef  # v3.6.0
@@ -269,8 +269,8 @@ jobs:
     runs-on: linux-amd64-cpu32
     timeout-minutes: 60
     needs:
-      - container-publish
-      - build-images
+      - build-images-docker
+      - build-images-ko
       - attest
       - sbom-ko
     env:
@@ -311,7 +311,7 @@ jobs:
             echo "value=${{ github.ref_name }}" >> $GITHUB_OUTPUT
           else
             SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
-            echo "value=${{ github.ref_name }}-${SHORT_SHA}" >> $GITHUB_OUTPUT
+            echo "value=${SHORT_SHA}" >> $GITHUB_OUTPUT
           fi
 
       - name: Prep system for multi-node Kind cluster