kubeflow · tarilabs · Dec 18, 2025 · Dec 19, 2025 · Dec 19, 2025 · Jan 5, 2026
diff --git a/.github/workflows/build-and-push-async-upload.yml b/.github/workflows/build-and-push-async-upload.yml
@@ -24,17 +24,23 @@ env:
   IMG_NAME: model-registry/job/async-upload
   REGISTRY_USER: ${{ github.actor }}
   REGISTRY_PWD: ${{ secrets.GITHUB_TOKEN }}
+  PLATFORMS: linux/arm64,linux/amd64
 
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      actions: read # anchore/sbom-action for syft
+      contents: write # anchore/sbom-action for syft
       packages: write
+      id-token: write # cosign
     steps:
     - name: Checkout repository
       uses: actions/[email protected]
 
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v3
+
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
 
@@ -57,16 +63,44 @@ jobs:
       run: |
         echo "VERSION=${{ github.ref_name }}" >> $GITHUB_ENV
 
+    - name: Extract metadata (tags, labels) for Docker
+      id: meta
+      uses: docker/metadata-action@v5
+      with:
+        images: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_NAME }}"
+        tags: |
+          type=raw,value=${{ env.VERSION }}
+          type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+          type=raw,value=main,enable=${{ github.ref == 'refs/heads/main' }}
+
     - name: Build and push Docker image
+      id: build-push
       uses: docker/build-push-action@v6
       with:
         context: ./jobs/async-upload
+        platforms: ${{ env.PLATFORMS }}
         push: true
-        tags: |
-          ${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_NAME }}:${{ env.VERSION }}
-          ${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_NAME }}:latest
-          ${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_NAME }}:main
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}
         cache-from: type=gha
         cache-to: type=gha,mode=max
-        provenance: mode=max # pay attention no secrets are passed as build arguments: https://docs.docker.com/build/ci/github-actions/attestations/#default-provenance:~:text=don%27t%20support%20attestations.-,Warning,-If%20you%27re%20using
-        sbom: true
+        provenance: mode=max
+
+    - name: Install Cosign
+      uses: sigstore/cosign-installer@v3
+
+    - name: Sign image with cosign
+      run: |
+        cosign sign --yes "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_NAME }}@${{ steps.build-push.outputs.digest }}"
+
+    - name: Generate SBOM
+      uses: anchore/sbom-action@v0
+      with:
+        image: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_NAME }}@${{ steps.build-push.outputs.digest }}"
+        format: spdx-json # default, but making sure of the format
+        artifact-name: "async-upload-${{ env.VERSION }}-sbom.spdx.json"
+        output-file: "async-upload-${{ env.VERSION }}-sbom.spdx.json" # pin the file to use it later below
+
+    - name: Attest SBOM to image
+      run: |
+        cosign attest --yes --predicate async-upload-${{ env.VERSION }}-sbom.spdx.json --type spdxjson "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_NAME }}@${{ steps.build-push.outputs.digest }}"
diff --git a/.github/workflows/build-and-push-csi-image.yml b/.github/workflows/build-and-push-csi-image.yml
@@ -22,13 +22,15 @@ env:
   PUSH_IMAGE: true
   DOCKER_USER: ${{ github.actor }}
   DOCKER_PWD: ${{ secrets.GITHUB_TOKEN }}
+  PLATFORMS: linux/arm64,linux/amd64
 jobs:
   build-csi-image:
     runs-on: ubuntu-latest
     permissions:
       actions: read # anchore/sbom-action for syft
       contents: write # anchore/sbom-action for syft
       packages: write
+      id-token: write # cosign
     steps:
       # Assign context variable for various action contexts (tag, main, CI)
       - name: Assigning tag context
@@ -39,6 +41,10 @@ jobs:
         run: echo "BUILD_CONTEXT=main" >> $GITHUB_ENV
       # checkout branch
       - uses: actions/[email protected]
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
       # set image version
       - name: Set main-branch environment
         if: env.BUILD_CONTEXT == 'main'
@@ -51,50 +57,46 @@ jobs:
         run: |
           echo "VERSION=${{ github.ref_name }}" >> $GITHUB_ENV
       # docker login
-      - name: Docker login
-        shell: bash
-        run: make docker/login
-      # build & push
-      - name: Build CSI Image
-        shell: bash
-        env:
-          IMG_ORG: ${{ env.IMG_ORG }}
-          IMG_REPO: ${{ env.IMG_REPO }}
-          IMG_VERSION: ${{ env.VERSION }}
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.IMG_REGISTRY }}
+          username: ${{ env.DOCKER_USER }}
+          password: ${{ env.DOCKER_PWD }}
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}"
+          tags: |
+            type=raw,value=${{ env.VERSION }}
+            type=raw,value=latest,enable=${{ env.BUILD_CONTEXT == 'main' }}
+            type=raw,value=main,enable=${{ env.BUILD_CONTEXT == 'main' }}
+      - name: Build and push Docker image
+        id: build-push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./cmd/csi/Dockerfile.csi
+          platforms: ${{ env.PLATFORMS }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          provenance: mode=max
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v3
+      - name: Sign image with cosign
         run: |
-          make image/build
-      - name: Push CSI Image
-        if: env.PUSH_IMAGE == 'true'
-        shell: bash
-        env:
-          IMG: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}"
-        run: IMG=${{ env.IMG }} IMG_VERSION=${{ env.VERSION }} make image/push
+          cosign sign --yes "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}@${{ steps.build-push.outputs.digest }}"
       - name: Generate SBOM
         uses: anchore/sbom-action@v0
         with:
-          image: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}:${{ env.VERSION }}"
+          image: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}@${{ steps.build-push.outputs.digest }}"
           format: spdx-json # default, but making sure of the format
-          artifact-name: "model-registry-server-${{ env.VERSION }}-sbom.spdx.json"
-          output-file: "model-registry-server-${{ env.VERSION }}-sbom.spdx.json" # pin the file to use it later below
-      - name: Install Cosign
-        uses: sigstore/cosign-installer@v3
-      - name: Attach SBOM to Image
-        run: |
-          cosign attach sbom --sbom model-registry-server-${{ env.VERSION }}-sbom.spdx.json "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}:${{ env.VERSION }}"
-      # Tag latest and main
-      - name: Tag Latest
-        if: env.BUILD_CONTEXT == 'main' && env.PUSH_IMAGE == 'true'
-        shell: bash
-        env:
-          IMG: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}"
-        run: |
-          docker tag ${{ env.IMG }}:$VERSION ${{ env.IMG }}:latest
-          IMG=${{ env.IMG }} IMG_VERSION=latest make image/push
-      - name: Tag Main
-        if: env.BUILD_CONTEXT == 'main' && env.PUSH_IMAGE == 'true'
-        shell: bash
-        env:
-          IMG: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}"
+          artifact-name: "storage-initializer-${{ env.VERSION }}-sbom.spdx.json"
+          output-file: "storage-initializer-${{ env.VERSION }}-sbom.spdx.json" # pin the file to use it later below
+      - name: Attest SBOM to image
         run: |
-          docker tag ${{ env.IMG }}:$VERSION ${{ env.IMG }}:main
-          IMG=${{ env.IMG }} IMG_VERSION=main make image/push
+          cosign attest --yes --predicate storage-initializer-${{ env.VERSION }}-sbom.spdx.json --type spdxjson "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}@${{ steps.build-push.outputs.digest }}"
diff --git a/.github/workflows/build-and-push-image.yml b/.github/workflows/build-and-push-image.yml
@@ -33,6 +33,7 @@ jobs:
       actions: read # anchore/sbom-action for syft
       contents: write # anchore/sbom-action for syft
       packages: write
+      id-token: write # cosign
     runs-on: ubuntu-latest
     needs: prepare
     steps:
@@ -62,27 +63,45 @@ jobs:
         if: env.BUILD_CONTEXT == 'tag'
         run: |
           echo "VERSION=${{ github.ref_name }}" >> $GITHUB_ENV
-      - name: Build and Push Image
-        shell: bash
-        run: ./scripts/build_deploy.sh
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.IMG_REGISTRY }}
+          username: ${{ env.DOCKER_USER }}
+          password: ${{ env.DOCKER_PWD }}
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}"
+          tags: |
+            type=raw,value=${{ env.VERSION }}
+            type=raw,value=latest,enable=${{ env.BUILD_CONTEXT == 'main' }}
+            type=raw,value=main,enable=${{ env.BUILD_CONTEXT == 'main' }}
+      - name: Build and push Docker image
+        id: build-push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: ${{ env.PLATFORMS }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          provenance: mode=max
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v3
+      - name: Sign image with cosign
+        run: |
+          cosign sign --yes "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}@${{ steps.build-push.outputs.digest }}"
       - name: Generate SBOM
         uses: anchore/sbom-action@v0
         with:
-          image: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}:${{ env.VERSION }}"
+          image: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}@${{ steps.build-push.outputs.digest }}"
           format: spdx-json # default, but making sure of the format
           artifact-name: "model-registry-server-${{ env.VERSION }}-sbom.spdx.json"
           output-file: "model-registry-server-${{ env.VERSION }}-sbom.spdx.json" # pin the file to use it later below
-      - name: Install Cosign
-        uses: sigstore/cosign-installer@v3
-      - name: Attach SBOM to Image
-        run: |
-          cosign attach sbom --sbom model-registry-server-${{ env.VERSION }}-sbom.spdx.json "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}:${{ env.VERSION }}"
-      - name: Tag Latest and Main
-        if: env.BUILD_CONTEXT == 'main'
-        shell: bash
-        env:
-          IMG: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}"
+      - name: Attest SBOM to image
         run: |
-          # Create manifest tags for multi-arch images
-          docker buildx imagetools create -t ${{ env.IMG }}:latest ${{ env.IMG }}:$VERSION
-          docker buildx imagetools create -t ${{ env.IMG }}:main ${{ env.IMG }}:$VERSION
+          cosign attest --yes --predicate model-registry-server-${{ env.VERSION }}-sbom.spdx.json --type spdxjson "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}@${{ steps.build-push.outputs.digest }}"
diff --git a/.github/workflows/build-and-push-ui-images-standalone.yml b/.github/workflows/build-and-push-ui-images-standalone.yml
@@ -21,16 +21,22 @@ env:
   IMG_UI_REPO: model-registry/ui-standalone # this image is intended for local development, not production
   DOCKER_USER: ${{ github.actor }}
   DOCKER_PWD: ${{ secrets.GITHUB_TOKEN }}
+  PLATFORMS: linux/arm64,linux/amd64
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      actions: read # anchore/sbom-action for syft
+      contents: write # anchore/sbom-action for syft
       packages: write
+      id-token: write # cosign
     steps:
     - name: Checkout repository
       uses: actions/[email protected]
 
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v3
+
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
 
@@ -47,7 +53,7 @@ jobs:
         commit_sha=${{ github.sha }}
         tag=main-${commit_sha:0:7}
         echo "VERSION=${tag}" >> $GITHUB_ENV
-      
+
     - name: Set tag environment
       if: startsWith(github.ref, 'refs/tags/v')
       run: |
@@ -68,9 +74,11 @@ jobs:
           type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
 
     - name: Build and push Docker image
+      id: build-push
       uses: docker/build-push-action@v6
       with:
         context: ./clients/ui
+        platforms: ${{ env.PLATFORMS }}
         push: true
         tags: ${{ steps.meta.outputs.tags }}
         labels: ${{ steps.meta.outputs.labels }}
@@ -79,5 +87,23 @@ jobs:
           STYLE_THEME=mui-theme
         cache-from: type=gha
         cache-to: type=gha,mode=max
-        provenance: mode=max # pay attention no secrets are passed as build arguments: https://docs.docker.com/build/ci/github-actions/attestations/#default-provenance:~:text=don%27t%20support%20attestations.-,Warning,-If%20you%27re%20using
-        sbom: true
+        provenance: mode=max
+
+    - name: Install Cosign
+      uses: sigstore/cosign-installer@v3
+
+    - name: Sign image with cosign
+      run: |
+        cosign sign --yes "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_UI_REPO }}@${{ steps.build-push.outputs.digest }}"
+
+    - name: Generate SBOM
+      uses: anchore/sbom-action@v0
+      with:
+        image: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_UI_REPO }}@${{ steps.build-push.outputs.digest }}"
+        format: spdx-json # default, but making sure of the format
+        artifact-name: "ui-standalone-${{ env.VERSION }}-sbom.spdx.json"
+        output-file: "ui-standalone-${{ env.VERSION }}-sbom.spdx.json" # pin the file to use it later below
+
+    - name: Attest SBOM to image
+      run: |
+        cosign attest --yes --predicate ui-standalone-${{ env.VERSION }}-sbom.spdx.json --type spdxjson "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_UI_REPO }}@${{ steps.build-push.outputs.digest }}"