docker/github-builder

.github/workflows/open-pr.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: checkout code in PR branch
-        uses: actions/checkout@v6.0.1
+        uses: actions/checkout@v6
       - name: Set up Docker
         uses: docker/setup-docker-action@v4
         with:
@@ -73,35 +73,29 @@ jobs:
           write-comment: true
           github-token: ${{ secrets.GITHUB_TOKEN }}
   multi-arch-build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: checkout code
-        uses: actions/checkout@v6.0.1
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: docker login dhi.io
-        uses: docker/login-action@v3
-        with:
-          registry: dhi.io
+    uses: docker/github-builder/.github/workflows/build.yml@v1
+    permissions:
+      contents: read # to fetch the repository content
+      id-token: write # for signing attestation(s) with GitHub OIDC Token
+    with:
+      output: image
+      push: false
+      platforms: linux/amd64,linux/arm64
+      setup-qemu: true
+      sbom: true
+      context: app/
+      meta-images: my-sample-workload
+      meta-tags: test
+    secrets:
+      registry-auths: |
+        - registry: dhi.io
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PAT }}
-      - name: build container image in multi-arch
-        uses: docker/build-push-action@v6
-        with:
-          context: app/
-          platforms: linux/amd64,linux/arm64
-          file: app/Dockerfile
-          push: false
-          provenance: mode=max
-          sbom: true
-          tags: "${{ env.WORKLOAD_NAME }}:test"
   make-compose-test:
     runs-on: ubuntu-24.04
     steps:
       - name: checkout code
-        uses: actions/checkout@v6.0.1
+        uses: actions/checkout@v6
       - name: install score-compose
         uses: score-spec/setup-score@v3
         with:
@@ -125,7 +119,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: checkout code
-        uses: actions/checkout@v6.0.1
+        uses: actions/checkout@v6
       - name: docker login dhi.io
         uses: docker/login-action@v3
         with:

.github/workflows/push-tag.yml

@@ -1,43 +1,30 @@
 name: push-tag
-permissions:
-  contents: read
-  id-token: write
-  packages: write
 on:
   push:
     tags:        
       - 'v*'
-env:
-  IMAGE_TAG: ${{ github.ref_name }}
-  WORKLOAD_NAME: my-sample-workload
 jobs:
   build-push:
-    runs-on: ubuntu-24.04
-    steps:
-      - name: checkout code
-        uses: actions/checkout@v6.0.1
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: login to ghcr
-        run: |
-          echo ${{ secrets.GITHUB_TOKEN }} | docker login \
-              ghcr.io \
-              -u $ \
-              --password-stdin
-      - name: docker login dhi.io
-        uses: docker/login-action@v3
-        with:
-          registry: dhi.io
+    uses: docker/github-builder/.github/workflows/build.yml@v1
+    permissions:
+      contents: read # to fetch the repository content
+      id-token: write # to sign attestation(s) with GitHub OIDC Token
+      packages: write # to push container image to ghcr
+    with:
+      output: image
+      push: true
+      platforms: linux/amd64,linux/arm64
+      setup-qemu: true
+      sbom: true
+      context: app/
+      meta-images: ghcr.io/${{ github.repository_owner }}/my-sample-workload
+      meta-tags: ${{ github.ref_name }},latest
+    secrets:
+      registry-auths: |
+        - registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+        - registry: dhi.io
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PAT }}
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: app/
-          platforms: linux/amd64,linux/arm64
-          push: true
-          provenance: mode=max
-          sbom: true
-          tags: "ghcr.io/${{ github.repository_owner }}/${{ env.WORKLOAD_NAME }}:${{ env.IMAGE_TAG }},ghcr.io/${{ github.repository_owner }}/${{ env.WORKLOAD_NAME }}:latest"
+