diff --git a/.github/workflows/build-publish-signed.yml b/.github/workflows/build-publish-signed.yml index 937f057..7538e27 100644 --- a/.github/workflows/build-publish-signed.yml +++ b/.github/workflows/build-publish-signed.yml @@ -11,6 +11,10 @@ jobs: name: Build and publish signed image runs-on: ubuntu-latest + env: + IMAGE_NAME: nginxproxy/${{ github.event.repository.name }} + IMAGE_TAG: signed + steps: - name: Checkout uses: actions/checkout@v4 @@ -27,53 +31,21 @@ jobs: docker trust key load delegation.key --name gha rm delegation.key - - name: Get Docker tags - id: docker_meta - uses: docker/metadata-action@v5 - with: - images: | - nginxproxy/${{ github.event.repository.name }} - tags: | - type=raw,value=signed - labels: | - org.opencontainers.image.authors=Nicolas Duchon (@buchdag) - flavor: | - latest=false - - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - name: Login to DockerHub uses: docker/login-action@v3 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - - name: Build and load the image - id: docker_build - uses: docker/build-push-action@v5 - with: - context: . - load: true - sbom: true - provenance: mode=max - tags: ${{ steps.docker_meta.outputs.tags }} - labels: ${{ steps.docker_meta.outputs.labels }} - cache-from: type=gha - cache-to: type=gha,mode=max + - name: Build the image + run: docker build -t ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} . - - name: Sign the image + - name: Push and sign the image env: DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: ${{ secrets.DCT_KEY_PASSPHRASE }} run: | - docker trust sign nginxproxy/${{ github.event.repository.name }}:signed + docker trust sign ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} - name: Verify the image signature run: | - docker trust inspect --pretty nginxproxy/${{ github.event.repository.name }}:signed - - - name: Images digests - run: echo ${{ steps.docker_build.outputs.digest }} + docker trust inspect --pretty ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}