Merge pull request #18906 from dsotirakis/patch-2

`docker/build-push-action`: Update attestations.md
This commit is contained in:
David Karlsson 2023-12-12 16:49:26 +01:00 committed by GitHub
commit 993c53a177
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 52 deletions

View File

@ -82,58 +82,7 @@ jobs:
## SBOM
SBOM attestations aren't automatically added to the image. To add SBOM
attestations, set the `sbom` input of the `docker/build-push-action` to `true.
Note that adding attestations to an image means you must push the image to a
registry directly, as opposed to loading the image to the local image store of
the runner. This is because the local image store doesn't support loading
images with attestations.
```yaml
name: ci
on:
push:
branches:
- "main"
env:
IMAGE_NAME: user/app
jobs:
docker:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Login to Docker Hub
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Extract metadata
id: meta
uses: docker/metadata-action@v4
with:
images: ${{ env.IMAGE_NAME }}
- name: Build and push image
uses: docker/build-push-action@v5
with:
context: .
sbom: true
tags: ${{ steps.meta.outputs.tags }}
```
## SBOM
SBOM attestations aren't automatically added to the image. To add SBOM
attestations, set the `sbom` input of the `docker/build-push-action` to `true.
attestations, set the `sbom` input of the `docker/build-push-action` to true.
Note that adding attestations to an image means you must push the image to a
registry directly, as opposed to loading the image to the local image store of