Verify base & sign commits/tags

Author: dflook

.github/workflows/release.yaml

@@ -53,8 +53,15 @@ jobs:
       - name: Build action image
         id: image_build
         env:
-          RELEASE_TAG: "test"
+          RELEASE_TAG: "test.0.0"
         run: |
+          BASE_TAG=$(docker buildx imagetools inspect danielflook/terraform-github-actions-base:latest --format '{{json .}}' | jq -r '.manifest.annotations."ref.tag"')
+          BASE_DIGEST=$(docker buildx imagetools inspect danielflook/terraform-github-actions-base:$BASE_TAG --format '{{json .}}' | jq -r '.manifest.digest')
+          
+          gh attestation verify --repo dflook/terraform-github-actions "oci://index.docker.io/danielflook/terraform-github-actions-base@$BASE_DIGEST"
+          
+          sed -i "s|FROM danielflook/terraform-github-actions-base:latest|FROM danielflook/terraform-github-actions-base@$BASE_DIGEST|" "image/Dockerfile"
+          
           docker buildx build \
             --build-arg FETCH_CHECKSUMS=yes \
             --build-arg VERSION="${RELEASE_TAG:1}" \
@@ -72,6 +79,7 @@ jobs:
             --annotation "index,manifest:builder-id=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
             --annotation "index,manifest:ref.tag=$RELEASE_TAG" \
             --annotation "index,manifest:org.opencontainers.image.base.name=docker.io/danielflook/terraform-github-actions-base" \
+            --annotation "index:org.opencontainers.image.base.ref=$BASE_TAG" \
             --push \
             --iidfile manifest-list-digest.txt \
             image
@@ -97,26 +105,34 @@ jobs:
       - image
     environment:
       name: release
-      url: https://github.com/dflook/terraform-github-actions/releases/tag/${{ github.event.release.tag_name }}${{ github.event.inputs.tag_name }}"
+      url: https://github.com/dflook/terraform-github-actions/releases/tag/test.0.0"
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          persist-credentials: true
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Configure git
+        env:
+          GPG_KEY: ${{ secrets.RELEASE_GPG_KEY }}
+        run: |
+          echo "$GPG_KEY" | gpg --import
+          git config --global user.name "Daniel Flook"
+          git config --global user.email "daniel@flook.org"
+          git config --global user.signingkey "26AAA6B35318E5B7CF0823170FDD1CF4BEE12274"
+          git config --global commit.gpgSign true
+          git config --global tag.gpgSign true
 
       - name: Release actions
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN }}
-          RELEASE_TAG: "${{ github.event.release.tag_name }}${{ github.event.inputs.tag_name }}"
+          RELEASE_TAG: "test.0.0"
           IMAGE_DIGEST: ${{ needs.image.outputs.digest }}
         run: |
-          exit 0
           export major=$(echo "$RELEASE_TAG" | cut -d. -f1)
           export minor=$(echo "$RELEASE_TAG" | cut -d. -f2)
 
-          git config --global user.name "Daniel Flook"
-          git config --global user.email "daniel@flook.org"
-          
           function prepare_release() {
               rsync -r "$GITHUB_WORKSPACE/$action/" "$HOME/$action"
               rm -rf "$HOME/$action/.github"
@@ -138,6 +154,9 @@ jobs:
               git -C "$HOME/$action" tag --force -a -m"$RELEASE_TAG" "$RELEASE_TAG"
               git -C "$HOME/$action" tag --force -a -m"$RELEASE_TAG" "$major"
               git -C "$HOME/$action" tag --force -a -m"$RELEASE_TAG" "$major.$minor"
+              git -C "$HOME/$action" tag --force -a -m"$RELEASE_TAG" "$RELEASE_TAG-dockerhub"
+              git -C "$HOME/$action" tag --force -a -m"$RELEASE_TAG" "$major-dockerhub"
+              git -C "$HOME/$action" tag --force -a -m"$RELEASE_TAG" "$major.$minor-dockerhub"
               git -C "$HOME/$action" push --force
               git -C "$HOME/$action" push --force --tags