feat: add Docker image publishing #28
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add Docker image publishing to GHCR and Docker Hub with: - Multi-architecture support (linux/amd64, linux/arm64) - Hadolint linting and Trivy security scanning in CI - Cosign keyless signing and SBOM attestation - Separate CI and release workflows Base image: dhi.io/debian-base:trixie (Docker Hardened Image) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
blobber | b1e0eeb | Commit Preview URL Branch Preview URL |
Jan 10 2026, 04:10 AM |
DHI (Docker Hardened Images) require authentication to pull, even though they're free. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
DHI images (dhi.io) require special registry authentication that's separate from Docker Hub. Switch to the official debian:trixie-slim image which is publicly available. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
Switch from debian:trixie-slim (which has CVEs) to gcr.io/distroless/static-debian12:nonroot which: - Has virtually no CVEs (minimal attack surface) - Is perfect for static Go binaries - Already runs as non-root (uid 65532) - Includes CA certificates Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Replace manual Cosign signing and Syft SBOM generation with GitHub's native `actions/attest-build-provenance` action. Changes: - Add `attestations: write` permission - Use `index.docker.io` prefix for Docker Hub (required for attestations) - Remove `sign-and-attest` job (3 separate jobs -> 1 job) - Remove `verify` job (use `gh attestation verify` instead) - Remove BuildKit provenance/sbom (redundant with GitHub attestations) Verification command: gh attestation verify oci://ghcr.io/meigma/blobber:latest -R meigma/blobber Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add SBOM generation using anchore/sbom-action and attestation using
actions/attest-sbom for both GHCR and Docker Hub images.
- Generate SBOM with Syft via anchore/sbom-action
- Attest SBOM to both registries with actions/attest-sbom
- Disable artifact upload (attestation is the primary distribution)
Verification:
gh attestation verify oci://ghcr.io/meigma/blobber:latest -R meigma/blobber \
--predicate-type https://spdx.dev/Document
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
ghcr.io/meigma/blobber) and Docker Hub (meigma/blobber)linux/amd64andlinux/arm64dhi.io/debian-base:trixie(Docker Hardened Image)Security
Workflows
docker-ci.ymldocker-release.ymlv*) / workflow_dispatchImage Tags
For a release like
v1.2.3:1.2.3- Full version1.2- Minor (rolling)1- Major (rolling)latest- Most recent releaseRequired Secrets
Before merging, add these secrets to the repository:
DOCKERHUB_USERNAME- Docker Hub usernameDOCKERHUB_TOKEN- Docker Hub access tokenTest plan
workflow_dispatchwith tagv1.1.0cosign verify🤖 Generated with Claude Code