Attest release image

Author: dflook

.github/workflows/release.yaml

@@ -1,27 +1,33 @@
 name: Release
 
 on:
-  release:
-    types:
-      - released
-  workflow_dispatch:
-    inputs:
-      tag_name:
-        description: "Tag to release"
-        required: true
+  push:
+#  release:
+#    types:
+#      - released
+#  workflow_dispatch:
+#    inputs:
+#      tag_name:
+#        description: "Tag to release"
+#        required: true
 
 permissions:
   contents: read
 
 jobs:
   image:
     runs-on: ubuntu-24.04
-    name: Release Actions
+    name: Build release image
     permissions:
       contents: read
       packages: write
-    env:
-      GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN }}
+      id-token: write
+      attestations: write
+    environment:
+      name: dockerhub
+      url: https://hub.docker.com/r/danielflook/terraform-github-actions-dev/tags?name="test"
+    outputs:
+      digest: ${{ steps.image_build.outputs.digest }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -47,26 +53,59 @@ jobs:
       - name: Build action image
         id: image_build
         env:
-          RELEASE_TAG: "${{ github.event.release.tag_name }}${{ github.event.inputs.tag_name }}"
+          RELEASE_TAG: "test"
         run: |
           docker buildx build \
             --build-arg FETCH_CHECKSUMS=yes \
             --build-arg VERSION="${RELEASE_TAG:1}" \
-            --tag "danielflook/terraform-github-actions:$RELEASE_TAG" \
-            --tag "ghcr.io/dflook/terraform-github-actions:$RELEASE_TAG" \
+            --tag "danielflook/terraform-github-actions-dev:$RELEASE_TAG" \
+            --tag "ghcr.io/dflook/terraform-github-actions-dev:$RELEASE_TAG" \
             --platform linux/amd64,linux/arm64 \
             --attest type=provenance,mode=max,builder-id=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID \
+            --annotation "index,manifest:org.opencontainers.image.created=$(date '+%Y-%m-%dT%H:%M:%S%z')" \
+            --annotation "index,manifest:org.opencontainers.image.source=https://github.com/${{ github.repository }}" \
+            --annotation "index,manifest:org.opencontainers.image.revision=${{ github.sha }}" \
+            --annotation "index,manifest:org.opencontainers.image.version=$RELEASE_TAG" \
+            --annotation "index,manifest:org.opencontainers.image.title=terraform-github-actions" \
+            --annotation "index,manifest:org.opencontainers.image.description=GitHub actions for terraform" \
+            --annotation "index:org.opencontainers.image.ref.name=docker.io/danielflook/terraform-github-actions-dev:$RELEASE_TAG" \
+            --annotation "index,manifest:builder-id=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
+            --annotation "index,manifest:ref.tag=$RELEASE_TAG" \
+            --annotation "index,manifest:org.opencontainers.image.base.name=docker.io/danielflook/terraform-github-actions-base" \
             --push \
             --iidfile manifest-list-digest.txt \
             image
 
           echo "digest=$(<manifest-list-digest.txt)" >> "$GITHUB_OUTPUT"
 
+      - name: Dockerhub ref attestation
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-name: index.docker.io/danielflook/terraform-github-actions-dev
+          subject-digest: ${{ steps.image_build.outputs.digest }}
+
+      - name: GHCR ref attestation
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-name: ghcr.io/dflook/terraform-github-actions-dev
+          subject-digest: ${{ steps.image_build.outputs.digest }}
+
+  actions:
+    runs-on: ubuntu-24.04
+    name: Release Actions
+    needs:
+      - image
+    environment:
+      name: release
+      url: https://github.com/dflook/terraform-github-actions/releases/tag/${{ github.event.release.tag_name }}${{ github.event.inputs.tag_name }}"
+    steps:
       - name: Release actions
         env:
+          GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN }}
           RELEASE_TAG: "${{ github.event.release.tag_name }}${{ github.event.inputs.tag_name }}"
-          IMAGE_DIGEST: ${{ steps.image_build.outputs.digest }}
+          IMAGE_DIGEST: ${{ needs.image.outputs.digest }}
         run: |
+          exit 0
           export major=$(echo "$RELEASE_TAG" | cut -d. -f1)
           export minor=$(echo "$RELEASE_TAG" | cut -d. -f2)
 
@@ -80,14 +119,14 @@ jobs:
               cp "$GITHUB_WORKSPACE/.github/FUNDING.yml" "$HOME/$action/.github/FUNDING.yml"
           }
 
-          for action in $(cd "$GITHUB_WORKSPACE" && find . -name action.yaml -printf "%h\n" | sed 's/^.\///'); do
+          for action in $(cd "$GITHUB_WORKSPACE" && find . -name action.yml -printf "%h\n" | sed 's/^.\///'); do
 
             if git clone "https://dflook:$GITHUB_TOKEN@github.com/dflook/$action.git" "$HOME/$action"; then
               echo "Releasing dflook/$action@$RELEASE_TAG"
 
               # git tags that use DockerHub for the image
               prepare_release
-              sed -i "s|  image:.*|  image: docker://danielflook/terraform-github-actions@$IMAGE_DIGEST|" "$HOME/$action/action.yaml"
+              sed -i "s|  image:.*|  image: docker://danielflook/terraform-github-actions-dev@$IMAGE_DIGEST|" "$HOME/$action/action.yaml"
 
               git -C "$HOME/$action" add -A
               git -C "$HOME/$action" commit -m "$RELEASE_TAG"
@@ -100,7 +139,7 @@ jobs:
               # git tags that use GitHub Container Registry for the image
               git -C "$HOME/$action" checkout ghcr || git -C "$HOME/$action" checkout -b ghcr
               prepare_release
-              sed -i "s|  image:.*|  image: docker://ghcr.io/dflook/terraform-github-actions@$IMAGE_DIGEST|" "$HOME/$action/action.yaml"
+              sed -i "s|  image:.*|  image: docker://ghcr.io/dflook/terraform-github-actions-dev@$IMAGE_DIGEST|" "$HOME/$action/action.yaml"
           
               git -C "$HOME/$action" add -A
               git -C "$HOME/$action" commit -m "$RELEASE_TAG-ghcr"

tga-release-test/action.yml

@@ -0,0 +1,12 @@
+name: tga-release-test
+description: Test the release of a Terraform GitHub Actions actions
+author: Daniel Flook
+
+runs:
+  using: docker
+  image: ../image/Dockerfile
+  entrypoint: /entrypoints/plan.sh
+
+branding:
+  icon: globe
+  color: purple