try more stuff

Signed-off-by: Josh Dolitsky <[email protected]>
wolfi-dev · Jul 17, 2023 · a4850d3 · a4850d3
1 parent 992a416
commit a4850d3
Showing 1 changed file with 18 additions and 7 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -18,18 +18,29 @@ jobs:
           command: |
             set -x
 
+            # Download an apko config file (maven)
             curl -L -o maven.apko.yaml \
               https://raw.githubusercontent.com/chainguard-images/images/main/images/maven/configs/openjdk-17.apko.yaml
 
-            cosign login ghcr.io -u "${{ github.repository_owner }}" -p "${{ github.token }}"
+            # Login to GHCR
+            cran auth login ghcr.io -u "${{ github.repository_owner }}" -p "${{ github.token }}"
 
-            REF="ghcr.io/jdolitsky/wolfi-act/testing/maven:latest"
-            apko publish maven.apko.yaml "${REF}" \
+            # Publish image using apko
+            repo="ghcr.io/${{ github.repository_owner }}/maven-test"
+            apko publish maven.apko.yaml "${repo}" \
               --repository-append=https://packages.wolfi.dev/os \
               --keyring-append=https://packages.wolfi.dev/os/wolfi-signing.rsa.pub \
               --package-append=wolfi-baselayout \
-              --arch=x86_64,aarch64
+              --arch=x86_64,aarch64 \
+              --image-refs=apko.images
+            index_digest="$(head -n 1 apko.images)"
 
-            crane manifest "${REF}"
-            grype "${REF}"
-            trivy image "${REF}"
+            # Sign image with cosign
+            cosign sign --yes $(cat apko.images)
+
+            # Scan image with grype and trivy
+            grype "${index_digest}"
+            trivy image "${index_digest}"
+
+            # Tag image using crane
+            crane cp "${index_digest}" "${repo}:latest"