docker/github-builder

[mathieu-benoit]

Use https://github.com/docker/github-builder for both open-pr and push-tag.

This workflow provides a trusted BuildKit instance and generates signed SLSA-compliant provenance attestations, guaranteeing the build happened from the source commit and all build steps ran in isolated sandboxed environments from immutable sources. This enables GitHub projects to follow a seamless path toward higher levels of security and trust.

Also, before this I was not yet signing (cosign/sigstore) the container image, that's now done by default with this docker/github-builder 🥳

cosign verify \
    --experimental-oci11 \
    --new-bundle-format \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-identity-regexp ^https://github.com/docker/github-builder/.github/workflows/build.yml.*$ \
    ghcr.io/mathieu-benoit/my-sample-workload@sha256:16205dc6b63ac7ed6e60bac8ff34b10d3dbfa03e01fce619bd0f398d2911ba5e \
    | jq .

Verification for ghcr.io/mathieu-benoit/my-sample-workload@sha256:16205dc6b63ac7ed6e60bac8ff34b10d3dbfa03e01fce619bd0f398d2911ba5e --
The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - Existence of the claims in the transparency log was verified offline
  - The code-signing certificate was verified using trusted certificate authority certificates
[
  {
    "critical": {
      "identity": {
        "docker-reference": "ghcr.io/mathieu-benoit/my-sample-workload@sha256:16205dc6b63ac7ed6e60bac8ff34b10d3dbfa03e01fce619bd0f398d2911ba5e"
      },
      "image": {
        "docker-manifest-digest": "sha256:16205dc6b63ac7ed6e60bac8ff34b10d3dbfa03e01fce619bd0f398d2911ba5e"
      },
      "type": "https://sigstore.dev/cosign/sign/v1"
    },
    "optional": {}
  }
]

Needed to do these follow up PRs too:

• Fix meta-images and meta-tags #214
• Remove setup-qemu from open-pr and push-tag #215
• Enable meta labels and annotations in workflow #216
• Update permissions in open-pr workflow #217

[github-actions]

Overview

Image reference	my-sample-workload:latest	my-sample-workload:latest
- digest	58d9e834af44	58d9e834af44
- tag	latest	latest
- provenance	a426cc7	a1d8fc2
- vulnerabilities
- platform	linux/amd64	linux/amd64
- size	55 MB	55 MB
- packages	18	18