add provenance and sbom inputs

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
docker · Dec 21, 2022 · 34b0f26 · 34b0f26
1 parent ea6d75b
commit 34b0f26
Show file tree

Hide file tree

Showing 6 changed files with 77 additions and 16 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -69,6 +69,47 @@ jobs:
             ${{ matrix.target }}
           push: false # set to true when https://github.com/docker/buildx/issues/179 is fixed
 
+  attests:
+    runs-on: ubuntu-latest
+    env:
+      BUILDX_VERSION: v0.10.0-rc2  # TODO: remove when Buildx v0.10.0 is released
+      BUILDKIT_IMAGE: moby/buildkit:v0.11.0-rc3  # TODO: remove when BuildKit v0.11.0 is released
+      DESTDIR: /tmp/bake-build
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+        with:
+          version: ${{ inputs.buildx-version || env.BUILDX_VERSION }}
+          driver-opts: |
+            network=host
+            image=${{ inputs.buildkit-image || env.BUILDKIT_IMAGE }}
+      -
+        name: Build
+        uses: ./
+        with:
+          workdir: ./test/go
+          targets: binary
+          provenance: mode=max,builder-id=https://github.com/${{ env.GITHUB_REPOSITORY }}/actions/runs/${{ env.GITHUB_RUN_ID }}
+      -
+        name: Check output folder
+        working-directory: ${{ env.DESTDIR }}
+        run: |
+          tree .
+      -
+        name: Print provenance
+        working-directory: ${{ env.DESTDIR }}
+        run: |
+          cat provenance.json | jq
+      -
+        name: Print SBOM
+        working-directory: ${{ env.DESTDIR }}
+        run: |
+          cat sbom.spdx.json | jq
+
   error-msg:
     runs-on: ubuntu-latest
     steps:

diff --git a/README.md b/README.md
@@ -80,18 +80,20 @@ Following inputs can be used as `step.with` keys
 > targets: default,release
 > ```
 
-| Name       | Type     | Description                                                                                                                                 |
-|------------|----------|---------------------------------------------------------------------------------------------------------------------------------------------|
-| `builder`  | String   | Builder instance (see [setup-buildx](https://github.com/docker/setup-buildx-action) action)                                                 |
-| `files`    | List/CSV | List of [bake definition files](https://docs.docker.com/build/customize/bake/file-definition/)                                              |
-| `workdir`  | String   | Working directory of execution                                                                                                              |
-| `targets`  | List/CSV | List of bake targets (`default` target used if empty)                                                                                       |
-| `no-cache` | Bool     | Do not use cache when building the image (default `false`)                                                                                  |
-| `pull`     | Bool     | Always attempt to pull a newer version of the image (default `false`)                                                                       |
-| `load`     | Bool     | Load is a shorthand for `--set=*.output=type=docker` (default `false`)                                                                      |
-| `push`     | Bool     | Push is a shorthand for `--set=*.output=type=registry` (default `false`)                                                                    |
-| `set`      | List     | List of [targets values to override](https://docs.docker.com/engine/reference/commandline/buildx_bake/#set) (eg: `targetpattern.key=value`) |
-| `source`   | String   | [Remote bake definition](https://docs.docker.com/build/customize/bake/file-definition/#remote-definition) to build from                     |
+| Name         | Type        | Description                                                                                                                                 |
+|--------------|-------------|---------------------------------------------------------------------------------------------------------------------------------------------|
+| `builder`    | String      | Builder instance (see [setup-buildx](https://github.com/docker/setup-buildx-action) action)                                                 |
+| `files`      | List/CSV    | List of [bake definition files](https://docs.docker.com/build/customize/bake/file-definition/)                                              |
+| `workdir`    | String      | Working directory of execution                                                                                                              |
+| `targets`    | List/CSV    | List of bake targets (`default` target used if empty)                                                                                       |
+| `no-cache`   | Bool        | Do not use cache when building the image (default `false`)                                                                                  |
+| `pull`       | Bool        | Always attempt to pull a newer version of the image (default `false`)                                                                       |
+| `load`       | Bool        | Load is a shorthand for `--set=*.output=type=docker` (default `false`)                                                                      |
+| `provenance` | Bool/String | [Provenance](https://docs.docker.com/build/attestations/provenance/) is a shorthand for `--set=*.attest=type=provenance`                    |
+| `push`       | Bool        | Push is a shorthand for `--set=*.output=type=registry` (default `false`)                                                                    |
+| `sbom`       | Bool/String | [SBOM](https://docs.docker.com/build/attestations/sbom/) is a shorthand for `--set=*.attest=type=sbom`                                      |
+| `set`        | List        | List of [targets values to override](https://docs.docker.com/engine/reference/commandline/buildx_bake/#set) (eg: `targetpattern.key=value`) |
+| `source`     | String      | [Remote bake definition](https://docs.docker.com/build/customize/bake/file-definition/#remote-definition) to build from                     |
 
 ### outputs
 

diff --git a/action.yml b/action.yml
@@ -32,10 +32,16 @@ inputs:
     description: "Load is a shorthand for --set=*.output=type=docker"
     required: false
     default: 'false'
+  provenance:
+    description: "Provenance is a shorthand for --set=*.attest=type=provenance"
+    required: false
   push:
     description: "Push is a shorthand for --set=*.output=type=registry"
     required: false
     default: 'false'
+  sbom:
+    description: "SBOM is a shorthand for --set=*.attest=type=sbom"
+    required: false
   set:
     description: "List of targets values to override (eg. targetpattern.key=value)"
     required: false

diff --git a/dist/index.js b/dist/index.js
diff --git a/dist/index.js.map b/dist/index.js.map
diff --git a/src/context.ts b/src/context.ts
@@ -16,7 +16,9 @@ export interface Inputs {
   noCache: boolean;
   pull: boolean;
   load: boolean;
+  provenance: string;
   push: boolean;
+  sbom: string;
   set: string[];
   source: string;
 }
@@ -41,7 +43,9 @@ export async function getInputs(): Promise<Inputs> {
     noCache: core.getBooleanInput('no-cache'),
     pull: core.getBooleanInput('pull'),
     load: core.getBooleanInput('load'),
+    provenance: core.getInput('provenance'),
     push: core.getBooleanInput('push'),
+    sbom: core.getInput('sbom'),
     set: getInputList('set', true),
     source: core.getInput('source')
   };
@@ -51,7 +55,7 @@ export async function getArgs(inputs: Inputs, buildxVersion: string): Promise<Ar
   // prettier-ignore
   return [
     ...await getBakeArgs(inputs, buildxVersion),
-    ...await getCommonArgs(inputs),
+    ...await getCommonArgs(inputs, buildxVersion),
     ...inputs.targets
   ];
 }
@@ -73,7 +77,7 @@ async function getBakeArgs(inputs: Inputs, buildxVersion: string): Promise<Array
   return args;
 }
 
-async function getCommonArgs(inputs: Inputs): Promise<Array<string>> {
+async function getCommonArgs(inputs: Inputs, buildxVersion: string): Promise<Array<string>> {
   const args: Array<string> = [];
   if (inputs.noCache) {
     args.push('--no-cache');
@@ -90,6 +94,14 @@ async function getCommonArgs(inputs: Inputs): Promise<Array<string>> {
   if (inputs.push) {
     args.push('--push');
   }
+  if (buildx.satisfies(buildxVersion, '>=0.10.0')) {
+    if (inputs.provenance) {
+      args.push('--provenance', inputs.provenance);
+    }
+    if (inputs.sbom) {
+      args.push('--sbom', inputs.sbom);
+    }
+  }
   return args;
 }