ScreenshotCreator/.github/workflows/Playwright.yml at 9c8708506e2d5211ae763fd43cc5f433c9a420c7 · mu88/ScreenshotCreator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
name: Playwright

on:
  workflow_dispatch:
  push:
    paths:
      - '.github/workflows/Playwright.yml'
      - 'src/ScreenshotCreator.Api/Dockerfile-Playwright'
      - 'src/ScreenshotCreator.Api/install-powershell-*.sh'

jobs:
  playwright:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write

    outputs:
      digests: ${{ steps.extract-digests.outputs.digests }}

    steps:
      - name: Check out code
        uses: actions/checkout@v5

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract .NET major version
        id: extract_version
        shell: pwsh
        run: |
          [xml]$xml = Get-Content 'Directory.Build.props'
          $tfm = $xml.Project.PropertyGroup.TargetFramework
          $majorVersion = [regex]::Match($tfm, '\d+').Value
          Write-Output "major_version=$majorVersion" >> $env:GITHUB_OUTPUT

      - name: Build and push Docker image for Playwright
        id: docker_build
        uses: docker/build-push-action@v6
        with:
          push: true
          provenance: false
          platforms: linux/arm64,linux/amd64
          tags: ghcr.io/mu88/screenshotcreator-playwright:latest,ghcr.io/mu88/screenshotcreator-playwright:${{ steps.extract_version.outputs.major_version }}.0.${{ github.run_number }}
          file: src/ScreenshotCreator.Api/Dockerfile-Playwright

      - name: Extract generated Docker image digests
        id: extract-digests
        shell: pwsh
        run: |
          $ErrorActionPreference = "Stop"
          $PSNativeCommandUseErrorActionPreference = $true

          docker pull ghcr.io/mu88/screenshotcreator-playwright:latest
          $digests = @()
          $images = @(
            "ghcr.io/mu88/screenshotcreator-playwright:latest"
            #,"ghcr.io/mu88/screenshotcreator-playwright:${{ steps.extract_version.outputs.major_version }}.0.${{ github.run_number }}"
          )

          foreach ($image in $images) {
            $manifest = docker manifest inspect $image | ConvertFrom-Json

            # Collect digests from all manifests (for multi-arch images)
            foreach ($item in $manifest.manifests) {
                $digest = $item.digest
                if ($digest -notin $digests) {
                    $digests += $digest
                }
            }

            # Add the digest for the image itself
            $imageDigest = "${{ steps.docker_build.outputs.digest }}"
            if ($imageDigest -notin $digests) {
                $digests += $imageDigest
            }
          }

          $json = $digests | ConvertTo-Json -Depth 10
          Write-Output "digests=$json" >> $env:GITHUB_OUTPUT

  attest_provenance_sbom:
    name: 'Attest Docker image build provenance and SBOM'
    runs-on: ubuntu-latest

    needs: playwright

    strategy:
      matrix:
        digest: ${{ fromJson(needs.playwright.outputs.digests) }}

    steps:
      - name: Check out code
        uses: actions/checkout@v5

      - name: Login to Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Attest build provenance
        uses: actions/attest-build-provenance@v3
        with:
          push-to-registry: true
          subject-name: ghcr.io/mu88/screenshotcreator-playwright
          subject-digest: ${{ matrix.digest }}

      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: ghcr.io/mu88/screenshotcreator-playwright@${{ matrix.digest }}
          output-file: sbom.json

      - name: Attest SBOM
        uses: actions/attest-sbom@v2
        with:
          push-to-registry: true
          sbom-path: sbom.json
          subject-name: ghcr.io/mu88/screenshotcreator-playwright
          subject-digest: ${{ matrix.digest }}