diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1f65e84..c3b7d55 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -11,6 +11,7 @@ env: REGISTRY: docker.io DOCKER_ORG: demonstrationorg IMAGE_NAME: demonstrationorg/juvenile + REGISTRY_IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} SHA: ${{ github.event.pull_request.head.sha || github.event.after }} DOCKERFILE_PATH: Dockerfile COMPARE_TAG: latest @@ -45,7 +46,7 @@ jobs: id: meta uses: docker/metadata-action@v4 with: - images: ${{ env.IMAGE_NAME }} + images: ${{ env.REGISTRY_IMAGE }} labels: | org.opencontainers.image.revision=${{ env.SHA }} com.docker.image.source.entrypoint=${{ env.DOCKERFILE_PATH }} @@ -59,20 +60,18 @@ jobs: - name: Log into DockerHub uses: docker/login-action@v2 with: - username: ${{secrets.DOCKER_USERNAME}} + username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} - - - name: Build and push by digest - id: build + - name: Build and push by digest uses: docker/build-push-action@v5 with: - context: . + context: . platforms: ${{ matrix.platform }} labels: ${{ steps.meta.outputs.labels }} outputs: type=image,name=${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }},push=true push: true - + - name: Export digest run: | mkdir -p /tmp/digests @@ -119,19 +118,8 @@ jobs: working-directory: /tmp/digests run: | docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ - $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *) + $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *) - name: Inspect image run: | - docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }} - - - name: Docker Scout - id: docker-scout - uses: docker/scout-action@v1 - with: - command: cves - image: ${{ steps.meta.outputs.tags }} - only-severities: critical,high - write-comment: true - platform: ${{ matrix.platform }} - github-token: ${{ secrets.GITHUB_TOKEN }} # to be able to write the comment + docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${