[ci] Enable OCI media types for container image attestations - #6629
Conversation
Docker Hub/Scout only discovers SBOM and provenance attestations via the OCI 1.1 Referrers API. BuildKit >=0.32 defaults to publishing attestations as OCI artifacts (with a subject descriptor Referrers lookups need) only when the image itself is pushed with OCI media types, which these steps weren't requesting. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Don't rely on BuildKit's implicit oci-artifact default (only enabled when oci-mediatypes=true, and only on BuildKit >=0.32) — request the subject-bearing attestation format directly so this doesn't silently regress to the legacy format on an older builder. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
|
Update: switched from relying on BuildKit's implicit `oci-artifact` default to setting it explicitly. Per the image/registry exporter docs, `oci-artifact` ("Format attestations as OCI artifacts") is a directly settable attribute — no need to depend on BuildKit's version-gated default (only auto-enabled when `oci-mediatypes=true` on BuildKit ≥0.32, per moby/buildkit#6914). Setting it explicitly (`outputs: type=image,oci-mediatypes=true,oci-artifact=true,push=true`) makes the attestation format independent of the runner's BuildKit version. (Also worth noting for anyone comparing against the buildx build docs: `--output type=oci` is a local tarball export, not a registry push mechanism — the relevant flags here belong to `type=image`/`type=registry` instead.) |
Description:
The published
existdb/existdbimage on Docker Hub carries valid SBOM (SPDX) and provenance (SLSA) attestations in its OCI index, but Docker Hub / Docker Scout report them as missing. Root cause: Scout discovers attestations via the OCI 1.1 Referrers API, which requires the attestation manifest to carry asubjectdescriptor pointing back to the image manifest it describes. BuildKit only emits thatsubjectfield (as an "OCI artifact" attestation) when the image itself is pushed with OCI media types — ourdocker/build-push-actionsteps didn't request that.This PR adds
oci-mediatypes=trueto theoutputsof both staging build/push steps (main + DEBUG), alongside the existingpush=true.What Changed:
.github/workflows/ci-container.yml: replacedpush: truewithoutputs: type=image,oci-mediatypes=true,push=trueon the "Build & push staging image (main)" and "Build & push staging image (DEBUG)" steps.Reference:
vnd.docker.reference.type: attestation-manifestannotation (which this workflow's own "Verify published manifest" step checks) is unchanged by this switch, so no other workflow changes are needed.Type of tests:
No new tests added — this is CI publish-pipeline configuration. Verification: this workflow's own "Verify published manifest (arch + attestations)" step already asserts attestation manifests are present; once merged, confirm on the next
developpublish run that Docker Hub /docker scout policy existdb/existdb:latestshows the SBOM and provenance requirements as satisfied rather than "Missing".