humocs-man/fluffy-pancake
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Refactor image digest retrieval in build workflow

Browse Source 
Updated the workflow to fetch the final image digest directly from GHCR instead of calculating it from the OCI archive.
This commit is contained in:
humocs-man
2026-05-17 14:58:51 +02:00
committed by GitHub
parent 54549c5b31
commit b4b96aee70
1 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build.yml
+6 -5
View File
@@ -143,7 +143,7 @@ jobs:
export REGISTRY_AUTH_FILE=$HOME/.docker/config.json export REGISTRY_AUTH_FILE=$HOME/.docker/config.json
REGISTRY_PATH="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}" REGISTRY_PATH="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}"
# Loop über alle Tags ohne das problematische --patch-config Flag # Loop über alle Tags
for tag in ${{ steps.metadata.outputs.tags }}; do for tag in ${{ steps.metadata.outputs.tags }}; do
skopeo copy \ skopeo copy \
--dest-compress-format=zstd \ --dest-compress-format=zstd \
@@ -152,9 +152,9 @@ jobs:
docker://$REGISTRY_PATH:$tag docker://$REGISTRY_PATH:$tag
done done
# Den finalen Digest ermitteln und für den nächsten Schritt in GITHUB_ENV schreiben # KORREKTUR: Wir fragen den echten, finalen Digest direkt von GHCR ab
DIGEST=$(skopeo inspect oci-archive:./chunkah-out/image.ociarchive --format '{{.Digest}}') FINAL_REGISTRY_DIGEST=$(skopeo inspect docker://$REGISTRY_PATH:${{ env.DEFAULT_TAG }} --format '{{.Digest}}')
echo "FINAL_IMAGE_DIGEST=$DIGEST" >> $GITHUB_ENV echo "REGISTRY_DIGEST=$FINAL_REGISTRY_DIGEST" >> $GITHUB_ENV
- name: Install Cosign - name: Install Cosign
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
@@ -163,7 +163,8 @@ jobs:
- name: Sign container image - name: Sign container image
if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
run: | run: |
cosign sign -y --key env://COSIGN_PRIVATE_KEY "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ env.FINAL_IMAGE_DIGEST }}" # Signiert den exakten, von der Registry bestätigten Digest
cosign sign -y --key env://COSIGN_PRIVATE_KEY "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ env.REGISTRY_DIGEST }}"
env: env:
COSIGN_EXPERIMENTAL: false COSIGN_EXPERIMENTAL: false
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}