ScreenshotCreator/.github/workflows/Playwright.yml at 1eeeb94838b8c8e977fec0ba53f71c421a655504 · mu88/ScreenshotCreator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
name: Playwright

on:
  workflow_dispatch:
  push:
    paths:
      - '.github/workflows/Playwright.yml'
      - 'src/ScreenshotCreator.Api/Dockerfile-Playwright'
      - 'src/ScreenshotCreator.Api/install-powershell-*.sh'

jobs:
  playwright:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write

    outputs:
      digests: ${{ steps.extract-digests.outputs.digests }}

    steps:
      - name: Check out code
        uses: actions/checkout@v6

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract .NET major version
        id: extract_version
        shell: pwsh
        run: |
          [xml]$xml = Get-Content 'Directory.Build.props'
          $tfm = $xml.Project.PropertyGroup.TargetFramework
          $majorVersion = [regex]::Match($tfm, '\d+').Value
          Write-Output "major_version=$majorVersion" >> $env:GITHUB_OUTPUT

      - name: Build and push Docker image for Playwright
        id: docker_build
        uses: docker/build-push-action@v6
        with:
          push: true
          provenance: false
          platforms: linux/arm64,linux/amd64
          tags: ghcr.io/mu88/screenshotcreator-playwright:latest,ghcr.io/mu88/screenshotcreator-playwright:${{ steps.extract_version.outputs.major_version }}.0.${{ github.run_number }}
          file: src/ScreenshotCreator.Api/Dockerfile-Playwright

      - name: Extract generated Docker image digests
        id: extract-digests
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $PSNativeCommandUseErrorActionPreference = $true

          $digests = @()
          $manifest = docker manifest inspect ghcr.io/mu88/screenshotcreator-playwright:${{ steps.extract_version.outputs.major_version }}.0.${{ github.run_number }} | ConvertFrom-Json

          # Collect digests from all manifests (for multi-arch images)
          foreach ($item in $manifest.manifests) {
              $digest = $item.digest
              if ($digest -notin $digests) {
                  $digests += $digest
              }
          }

          # Add the digest for the image itself
          $imageDigest = "${{ steps.docker_build.outputs.digest }}"
          if ($imageDigest -notin $digests) {
              $digests += $imageDigest
          }

          $json = $digests | ConvertTo-Json -Compress
          Write-Host "Extracted digests: $json"
          Write-Output "digests=$json" >> $env:GITHUB_OUTPUT

  attest_provenance_sbom:
    name: 'Attest Docker image build provenance and SBOM'
    runs-on: ubuntu-latest

    needs: playwright

    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write

    strategy:
      matrix:
        digest: ${{ fromJson(needs.playwright.outputs.digests) }}

    steps:
      - name: Check out code
        uses: actions/checkout@v6

      - name: Login to Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Attest build provenance
        uses: actions/attest-build-provenance@v4
        with:
          push-to-registry: true
          subject-name: ghcr.io/mu88/screenshotcreator-playwright
          subject-digest: ${{ matrix.digest }}

      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: ghcr.io/mu88/screenshotcreator-playwright@${{ matrix.digest }}
          output-file: sbom.json

      - name: Attest SBOM
        uses: actions/attest-sbom@v4
        with:
          push-to-registry: true
          sbom-path: sbom.json
          subject-name: ghcr.io/mu88/screenshotcreator-playwright
          subject-digest: ${{ matrix.digest }}