actions/build-push-action
2
0
Fork 0
mirror of https://github.com/docker/build-push-action.git synced 2025-04-23 03:26:46 +00:00
Code Issues Projects Releases Packages Wiki Activity

disable provenance by default if not set

Browse source 
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
This commit is contained in:
CrazyMax 2023-01-27 14:06:06 +01:00
parent 37abcedcc1
commit 337a09d182
No known key found for this signature in database
GPG key ID: 3248E46B6BB8C7F7
3 changed files with 45 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

35
src/context.ts
View file

@ -169,17 +169,14 @@ async function getBuildArgs(inputs: Inputs, defaultContext: string, context: str
if (inputs.provenance) {
args.push('--provenance', inputs.provenance);
} else if ((await buildx.satisfiesBuildKitVersion(inputs.builder, '>=0.11.0', standalone)) && !hasDockerExport(inputs)) {
// if provenance not specified and BuildKit version compatible for
// attestation, set default provenance. Also needs to make sure user
// If provenance not specified but BuildKit version compatible for
// attestation, disable provenance anyway. Also needs to make sure user
// doesn't want to explicitly load the image to docker.
if (fromPayload('repository.private') !== false) {
// if this is a private repository, we set the default provenance
// attributes being set in buildx: https://github.com/docker/buildx/blob/fb27e3f919dcbf614d7126b10c2bc2d0b1927eb6/build/build.go#L603
args.push('--provenance', getProvenanceAttrs(`mode=min,inline-only=true`));
} else {
// for a public repository, we set max provenance mode.
args.push('--provenance', getProvenanceAttrs(`mode=max`));
}
// While this action successfully pushes OCI compliant images to
// well-known registries, some runtimes (e.g. Google Cloud Run and AWS
// Lambda) are not able to pull resulting image from their own registry...
// See also https://github.com/docker/buildx/issues/1533
args.push('--provenance', 'false');
}
if (inputs.sbom) {
args.push('--sbom', inputs.sbom);
@ -281,24 +278,6 @@ export const asyncForEach = async (array, callback) => {
}
};
// eslint-disable-next-line @typescript-eslint/no-explicit-any
function fromPayload(path: string): any {
return select(github.context.payload, path);
}
// eslint-disable-next-line @typescript-eslint/no-explicit-any
function select(obj: any, path: string): any {
if (!obj) {
return undefined;
}
const i = path.indexOf('.');
if (i < 0) {
return obj[path];
}
const key = path.slice(0, i);
return select(obj[key], path.slice(i + 1));
}
function getProvenanceInput(name: string): string {
const input = core.getInput(name);
if (!input) {