Skip to content

Commit

Permalink
Merge pull request #18906 from dsotirakis/patch-2
Browse files Browse the repository at this point in the history
`docker/build-push-action`: Update attestations.md
  • Loading branch information
dvdksn authored Dec 12, 2023
2 parents 4f3e7d2 + 24581df commit 993c53a
Showing 1 changed file with 1 addition and 52 deletions.
53 changes: 1 addition & 52 deletions content/build/ci/github-actions/attestations.md
Original file line number Diff line number Diff line change
Expand Up @@ -82,58 +82,7 @@ jobs:
## SBOM
SBOM attestations aren't automatically added to the image. To add SBOM
attestations, set the `sbom` input of the `docker/build-push-action` to `true.

Note that adding attestations to an image means you must push the image to a
registry directly, as opposed to loading the image to the local image store of
the runner. This is because the local image store doesn't support loading
images with attestations.

```yaml
name: ci
on:
push:
branches:
- "main"
env:
IMAGE_NAME: user/app
jobs:
docker:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Login to Docker Hub
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Extract metadata
id: meta
uses: docker/metadata-action@v4
with:
images: ${{ env.IMAGE_NAME }}
- name: Build and push image
uses: docker/build-push-action@v5
with:
context: .
sbom: true
tags: ${{ steps.meta.outputs.tags }}
```

## SBOM

SBOM attestations aren't automatically added to the image. To add SBOM
attestations, set the `sbom` input of the `docker/build-push-action` to `true.
attestations, set the `sbom` input of the `docker/build-push-action` to true.

Note that adding attestations to an image means you must push the image to a
registry directly, as opposed to loading the image to the local image store of
Expand Down

0 comments on commit 993c53a

Please sign in to comment.