From cbfe083f8ab00598231bccc26f93a4f8ea88eb5e Mon Sep 17 00:00:00 2001 From: Christopher Paul Date: Wed, 3 Jun 2026 16:15:20 -0400 Subject: [PATCH 1/9] [ACR] Add Docker image build and provenance attestations to ACR Add a separate workflow to build and push the OCI image to Azure Container Registry (ACR) with build provenance attestations. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/release_acr.yaml | 56 ++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 .github/workflows/release_acr.yaml diff --git a/.github/workflows/release_acr.yaml b/.github/workflows/release_acr.yaml new file mode 100644 index 0000000..09224e1 --- /dev/null +++ b/.github/workflows/release_acr.yaml @@ -0,0 +1,56 @@ +name: Release to ACR test + +on: + workflow_dispatch: + push: + branches: + - main + +permissions: + contents: read + +jobs: + release: + name: Build and Release OCI Image + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + id-token: write + attestations: write + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Set image tag + id: version + run: echo "tag=v0.0.0-acr-test" >> $GITHUB_OUTPUT + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 + + - name: Log in to Azure Container Registry (ACR) + uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + with: + registry: ${{ secrets.ACR_MODA_REGISTRY }} + username: ${{ secrets.ACR_MODA_USER }} + password: ${{ secrets.ACR_MODA_TOKEN }} + + - name: Build and push Docker image to ACR + id: build + uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 + with: + context: . + file: ./Dockerfile + push: true + tags: ${{ secrets.ACR_MODA_REGISTRY }}/github/artifact-attestations-opa-provider:${{ steps.version.outputs.tag }} + platforms: linux/amd64,linux/arm64 + + - name: Attest build provenance for ACR + uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 + with: + subject-name: ${{ secrets.ACR_MODA_REGISTRY }}/github/artifact-attestations-opa-provider + subject-digest: ${{ steps.build.outputs.digest }} + push-to-registry: true From bea623b8319e1d7d0c8bccfa23e0a8b859d57d96 Mon Sep 17 00:00:00 2001 From: Christopher Paul Date: Wed, 3 Jun 2026 16:30:21 -0400 Subject: [PATCH 2/9] publish acr --- .github/workflows/release.yaml | 24 ++++++++++++++++++++++++ .github/workflows/release_acr.yaml | 2 +- 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index ec11a2d..de98bab 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -56,3 +56,27 @@ jobs: subject-name: ghcr.io/github/artifact-attestations-opa-provider subject-digest: ${{ steps.push.outputs.digest }} push-to-registry: true + + - name: Log in to Azure Container Registry (ACR) + uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 + with: + registry: ${{ secrets.ACR_MODA_REGISTRY }} + username: ${{ secrets.ACR_MODA_USER }} + password: ${{ secrets.ACR_MODA_TOKEN }} + + - name: Build and push Docker image to ACR + id: build + uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 + with: + context: . + file: ./Dockerfile + push: true + tags: ${{ secrets.ACR_MODA_REGISTRY }}/github/artifact-attestations-opa-provider:${{ steps.version.outputs.tag }} + platforms: linux/amd64,linux/arm64 + + - name: Attest build provenance for ACR + uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 + with: + subject-name: ${{ secrets.ACR_MODA_REGISTRY }}/github/artifact-attestations-opa-provider + subject-digest: ${{ steps.build.outputs.digest }} + push-to-registry: true diff --git a/.github/workflows/release_acr.yaml b/.github/workflows/release_acr.yaml index 09224e1..db3fb0b 100644 --- a/.github/workflows/release_acr.yaml +++ b/.github/workflows/release_acr.yaml @@ -4,7 +4,7 @@ on: workflow_dispatch: push: branches: - - main + - publish-acr permissions: contents: read From 3205c6d04bbcf97fd867f3189cd21e5ef9af03d1 Mon Sep 17 00:00:00 2001 From: Christopher Paul Date: Thu, 11 Jun 2026 15:49:39 -0400 Subject: [PATCH 3/9] fix: remove github/ prefix from ACR image path The scoped ACR token grants access to 'repositories/artifact-attestations-opa-provider' not 'repositories/github/artifact-attestations-opa-provider'. Remove the github/ prefix to match the token scope. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/release_acr.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release_acr.yaml b/.github/workflows/release_acr.yaml index db3fb0b..3c1a624 100644 --- a/.github/workflows/release_acr.yaml +++ b/.github/workflows/release_acr.yaml @@ -45,12 +45,12 @@ jobs: context: . file: ./Dockerfile push: true - tags: ${{ secrets.ACR_MODA_REGISTRY }}/github/artifact-attestations-opa-provider:${{ steps.version.outputs.tag }} + tags: ${{ secrets.ACR_MODA_REGISTRY }}/artifact-attestations-opa-provider:${{ steps.version.outputs.tag }} platforms: linux/amd64,linux/arm64 - name: Attest build provenance for ACR uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 with: - subject-name: ${{ secrets.ACR_MODA_REGISTRY }}/github/artifact-attestations-opa-provider + subject-name: ${{ secrets.ACR_MODA_REGISTRY }}/artifact-attestations-opa-provider subject-digest: ${{ steps.build.outputs.digest }} push-to-registry: true From 65b4131558eb08c0e3b4459a6851e6a587cd55d3 Mon Sep 17 00:00:00 2001 From: Christopher Paul Date: Thu, 11 Jun 2026 17:07:00 -0400 Subject: [PATCH 4/9] ACR is flat --- .github/workflows/release.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index de98bab..ccb48b0 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -71,12 +71,12 @@ jobs: context: . file: ./Dockerfile push: true - tags: ${{ secrets.ACR_MODA_REGISTRY }}/github/artifact-attestations-opa-provider:${{ steps.version.outputs.tag }} + tags: ${{ secrets.ACR_MODA_REGISTRY }}/artifact-attestations-opa-provider:${{ steps.version.outputs.tag }} platforms: linux/amd64,linux/arm64 - name: Attest build provenance for ACR uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 with: - subject-name: ${{ secrets.ACR_MODA_REGISTRY }}/github/artifact-attestations-opa-provider + subject-name: ${{ secrets.ACR_MODA_REGISTRY }}/artifact-attestations-opa-provider subject-digest: ${{ steps.build.outputs.digest }} push-to-registry: true From 6b6fa3bec38c086990fcbff891cd32f8b064acf3 Mon Sep 17 00:00:00 2001 From: Christopher Paul Date: Thu, 11 Jun 2026 17:07:09 -0400 Subject: [PATCH 5/9] tag should be correct --- .github/workflows/release_acr.yaml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release_acr.yaml b/.github/workflows/release_acr.yaml index 3c1a624..2b48e29 100644 --- a/.github/workflows/release_acr.yaml +++ b/.github/workflows/release_acr.yaml @@ -24,9 +24,12 @@ jobs: with: persist-credentials: false - - name: Set image tag + - name: Extract version from tag id: version - run: echo "tag=v0.0.0-acr-test" >> $GITHUB_OUTPUT + run: | + # Extract the tag name (e.g., v1.0.0) + TAG=${GITHUB_REF#refs/tags/} + echo "tag=${TAG}" >> $GITHUB_OUTPUT - name: Set up Docker Buildx uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 From 2f210b52c3d8afd57b7fae1368e62efbb82cf107 Mon Sep 17 00:00:00 2001 From: Christopher Paul Date: Fri, 12 Jun 2026 12:36:15 -0400 Subject: [PATCH 6/9] Fix Docker tag extraction for branch-triggered builds Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/release_acr.yaml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release_acr.yaml b/.github/workflows/release_acr.yaml index 2b48e29..8a1e1d2 100644 --- a/.github/workflows/release_acr.yaml +++ b/.github/workflows/release_acr.yaml @@ -24,12 +24,11 @@ jobs: with: persist-credentials: false - - name: Extract version from tag + - name: Extract version from ref id: version run: | - # Extract the tag name (e.g., v1.0.0) - TAG=${GITHUB_REF#refs/tags/} - echo "tag=${TAG}" >> $GITHUB_OUTPUT + # Works for both tags (refs/tags/v1.0.0) and branches (refs/heads/publish-acr) + echo "tag=${GITHUB_REF_NAME}" >> $GITHUB_OUTPUT - name: Set up Docker Buildx uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 From e7df13f27b5b96768a80934338dd125056fb39e1 Mon Sep 17 00:00:00 2001 From: Christopher Paul Date: Fri, 12 Jun 2026 13:33:48 -0400 Subject: [PATCH 7/9] Fix ACR tag: use dev for branch pushes, version for tag pushes Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/release_acr.yaml | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release_acr.yaml b/.github/workflows/release_acr.yaml index 8a1e1d2..bbc8ea1 100644 --- a/.github/workflows/release_acr.yaml +++ b/.github/workflows/release_acr.yaml @@ -1,10 +1,12 @@ -name: Release to ACR test +name: Release to ACR on: workflow_dispatch: push: branches: - publish-acr + tags: + - 'v*.*.*' permissions: contents: read @@ -24,11 +26,16 @@ jobs: with: persist-credentials: false - - name: Extract version from ref + - name: Determine image tag id: version run: | - # Works for both tags (refs/tags/v1.0.0) and branches (refs/heads/publish-acr) - echo "tag=${GITHUB_REF_NAME}" >> $GITHUB_OUTPUT + if [[ "$GITHUB_REF" == refs/tags/* ]]; then + # Tagged release: use the version tag (e.g., v1.0.0) + echo "tag=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT + else + # Branch push or workflow_dispatch: use dev tag + echo "tag=dev" >> $GITHUB_OUTPUT + fi - name: Set up Docker Buildx uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 From 7c1427e06806438fda5d970384c783f3e1c2f2c4 Mon Sep 17 00:00:00 2001 From: Christopher Paul Date: Fri, 12 Jun 2026 14:23:06 -0400 Subject: [PATCH 8/9] build and push dev tag to ACR Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/release_acr.yaml | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) diff --git a/.github/workflows/release_acr.yaml b/.github/workflows/release_acr.yaml index bbc8ea1..6c87004 100644 --- a/.github/workflows/release_acr.yaml +++ b/.github/workflows/release_acr.yaml @@ -26,17 +26,6 @@ jobs: with: persist-credentials: false - - name: Determine image tag - id: version - run: | - if [[ "$GITHUB_REF" == refs/tags/* ]]; then - # Tagged release: use the version tag (e.g., v1.0.0) - echo "tag=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT - else - # Branch push or workflow_dispatch: use dev tag - echo "tag=dev" >> $GITHUB_OUTPUT - fi - - name: Set up Docker Buildx uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 @@ -54,7 +43,7 @@ jobs: context: . file: ./Dockerfile push: true - tags: ${{ secrets.ACR_MODA_REGISTRY }}/artifact-attestations-opa-provider:${{ steps.version.outputs.tag }} + tags: ${{ secrets.ACR_MODA_REGISTRY }}/artifact-attestations-opa-provider:dev platforms: linux/amd64,linux/arm64 - name: Attest build provenance for ACR From 68cfcfdc048204d3ae8adf9c07a278c071d07bbd Mon Sep 17 00:00:00 2001 From: Christopher Paul Date: Fri, 12 Jun 2026 16:49:26 -0400 Subject: [PATCH 9/9] backfill completed so remove temp workflow --- .github/workflows/release_acr.yaml | 54 ------------------------------ 1 file changed, 54 deletions(-) delete mode 100644 .github/workflows/release_acr.yaml diff --git a/.github/workflows/release_acr.yaml b/.github/workflows/release_acr.yaml deleted file mode 100644 index 6c87004..0000000 --- a/.github/workflows/release_acr.yaml +++ /dev/null @@ -1,54 +0,0 @@ -name: Release to ACR - -on: - workflow_dispatch: - push: - branches: - - publish-acr - tags: - - 'v*.*.*' - -permissions: - contents: read - -jobs: - release: - name: Build and Release OCI Image - runs-on: ubuntu-latest - permissions: - contents: read - packages: write - id-token: write - attestations: write - steps: - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - persist-credentials: false - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 - - - name: Log in to Azure Container Registry (ACR) - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 - with: - registry: ${{ secrets.ACR_MODA_REGISTRY }} - username: ${{ secrets.ACR_MODA_USER }} - password: ${{ secrets.ACR_MODA_TOKEN }} - - - name: Build and push Docker image to ACR - id: build - uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 - with: - context: . - file: ./Dockerfile - push: true - tags: ${{ secrets.ACR_MODA_REGISTRY }}/artifact-attestations-opa-provider:dev - platforms: linux/amd64,linux/arm64 - - - name: Attest build provenance for ACR - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 - with: - subject-name: ${{ secrets.ACR_MODA_REGISTRY }}/artifact-attestations-opa-provider - subject-digest: ${{ steps.build.outputs.digest }} - push-to-registry: true