免费在 GitHub 公开

add-artifact-attestations-to-workflow

Add SLSA build-provenance attestations to existing GitHub Actions workflows. Use when the user wants to add artifact attestations, build provenance, or SLSA attestations to Docker container image builds in GitHub Actions CI/CD pipelines.

中文简介正在准备中。当前显示原文说明。

jim60105/copilot-prompt

集成工具GitHub Docker

查看安装方法

包含的文件（1）

SKILL.md3.8 KB

SKILL.md（原文）

安装前可以查看交给 AI 代理的指令内容。

Add Artifact Attestations to Workflow

Add SLSA build-provenance attestations to existing GitHub Actions workflows for Docker container images.

Steps

Find existing workflow files in .github/workflows/ that contain docker/build-push-action or similar steps. Note that composite actions may be used — read both the composite action and the calling workflow simultaneously.
Enable OIDC & Attestations permissions In each workflow's top-level permissions: block, grant both the OIDC token and attestations write privileges:
```
permissions:
  id-token: write
  attestations: write
  contents: read       # (existing)
  packages: write      # (existing)
```

Log in to container registries Ensure authentication steps exist for each registry you'll attest against. Judge whether there are omissions based on the implemented content, rather than always logging into all registries.

- name: Login to GHCR
  uses: docker/login-action@v3
  with:
    registry: ghcr.io
    username: ${{ github.actor }}
    password: ${{ secrets.GITHUB_TOKEN }}

- name: Login to Docker Hub
  uses: docker/login-action@v3
  with:
    registry: index.docker.io
    username: ${{ secrets.DOCKERHUB_USERNAME }}
    password: ${{ secrets.DOCKERHUB_TOKEN }}

- name: Login to Quay
  uses: docker/login-action@v3
  with:
    registry: quay.io
    username: ${{ secrets.QUAY_USERNAME }}
    password: ${{ secrets.QUAY_TOKEN }}

Build & push image, capturing the digest Use docker/build-push-action@v* with an id to reference its output. Judge tags based on implemented content.

- name: Build and push image
  id: build_push
  uses: docker/build-push-action@v5
  with:
    context: .
    push: true
    tags: |
      ghcr.io/${{ github.repository }}:latest
      index.docker.io/${{ secrets.DOCKERHUB_USERNAME }}/your-repo:latest
      quay.io/${{ github.repository_owner }}/your-repo:latest

Add attestation steps After the build_push step, insert one actions/attest-build-provenance@v3 invocation per registry. The subject-name is the full image name without a tag. The subject-digest comes from the build step's output. Judge which registries to use based on implemented content.

- name: Attest GHCR image
  uses: actions/attest-build-provenance@v3
  with:
    subject-name: ghcr.io/${{ github.repository }}
    subject-digest: ${{ steps.build_push.outputs.digest }}

- name: Attest Docker Hub image
  uses: actions/attest-build-provenance@v3
  with:
    subject-name: index.docker.io/${{ secrets.DOCKERHUB_USERNAME }}/your-repo
    subject-digest: ${{ steps.build_push.outputs.digest }}

- name: Attest Quay image
  uses: actions/attest-build-provenance@v3
  with:
    subject-name: quay.io/${{ github.repository_owner }}/your-repo
    subject-digest: ${{ steps.build_push.outputs.digest }}

Commit changes Write the git commit message in English.

git add .github/workflows/docker_publish.yml # or whatever files you modified
git commit --signoff -m "ci: add build-provenance attestations for container images"

Ask the user to push Tell the user to manually push the changes and verify attestations are created successfully. DO NOT perform a git push.

评价

还没有评价。欢迎分享你的使用感受。

无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。

还没有评论。来写第一条吧。

同一仓库的技能

agent-browser

免费

Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to "open a website", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction.

中文简介正在准备中。当前显示原文说明。