docker/bake-action
1
0
Fork 0
mirror of https://git.flexiblyrigid.au/actions/bake-action.git synced 2025-12-06 07:48:05 +08:00
Code Issues Packages Projects Releases Wiki Activity

check provenance attestation set in bake definition before overriding

Browse Source 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
This commit is contained in:
CrazyMax
2025-11-26 12:02:17 +01:00
parent 41c10f2beb
commit 8ba51ac4ee
5 changed files with 79 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
src/context.ts
View File

@@ -90,16 +90,22 @@ async function getBakeArgs(inputs: Inputs, definition: BakeDefinition, toolkit:
if (inputs.provenance) {
args.push('--provenance', inputs.provenance);
} else if (!noDefaultAttestations() && (await toolkit.buildkit.versionSatisfies(inputs.builder, '>=0.11.0')) && !Bake.hasDockerExporter(definition, inputs.load)) {
// if provenance not specified and BuildKit version compatible for
// check if provenance attestation is already specified in the bake
// definition and if not specified and BuildKit version compatible for
// attestation, set default provenance. Also needs to make sure user
// doesn't want to explicitly load the image to docker.
if (GitHub.context.payload.repository?.private ?? false) {
// if this is a private repository, we set the default provenance
// attributes being set in buildx: https://github.com/docker/buildx/blob/fb27e3f919dcbf614d7126b10c2bc2d0b1927eb6/build/build.go#L603
args.push('--provenance', Build.resolveProvenanceAttrs(`mode=min,inline-only=true`));
} else {
// for a public repository, we set max provenance mode.
args.push('--provenance', Build.resolveProvenanceAttrs(`mode=max`));
for (const targetName in definition.target) {
const target = definition.target[targetName];
if (!Array.isArray(target.attest) || !target.attest.some(attest => attest?.type === 'provenance')) {
if (GitHub.context.payload.repository?.private ?? false) {
// if this is a private repository, we set the default provenance
// attributes being set in buildx: https://github.com/docker/buildx/blob/fb27e3f919dcbf614d7126b10c2bc2d0b1927eb6/build/build.go#L603
args.push('--set', `${targetName}.attest=type=provenance,${Build.resolveProvenanceAttrs(`mode=min,inline-only=true`)}`);
} else {
// for a public repository, we set max provenance mode.
args.push('--set', `${targetName}.attest=type=provenance,${Build.resolveProvenanceAttrs(`mode=max`)}`);
}
}
}
}
if (inputs.sbom) {