Skip to content

Disable provenance/SBOM attestations #92

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
frenzymadness wants to merge 10 commits into
base: master
Choose a base branch
from
+70 −63
Draft

Disable provenance/SBOM attestations #92

Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
c9cc80b
Disable provenance/SBOM attestations
frenzymadness Feb 16, 2026
4cee140
Update docker/build-push-action to version 6
frenzymadness Feb 16, 2026
93ceaab
Add verification step for single-platform images
frenzymadness Feb 17, 2026
6e13b40
Use manifest inspect in the verification step, not image inspect
frenzymadness Feb 17, 2026
4a38b1e
Disable provenance and sbom attestations again
frenzymadness Feb 18, 2026
fd358ef
fixup
frenzymadness Feb 19, 2026
ccc85a7
fixup
frenzymadness Feb 19, 2026
a3a523f
fixup
frenzymadness Feb 20, 2026
c8c381b
fixup
frenzymadness Feb 20, 2026
534ca25
fixup
frenzymadness Feb 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
133 changes: 70 additions & 63 deletions .github/workflows/build-and-push.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,8 @@ env:
FEDORA_VERSION: 42

jobs:
build-and-push:
name: Build, test and push
build-and-test:
name: Build and test ${{ matrix.arch }}
runs-on: ubuntu-latest
strategy:
matrix:
Expand All @@ -31,52 +31,63 @@ jobs:
toxenv: py39,py310,py312
steps:
- name: Checkout
uses: actions/checkout@v2
uses: actions/checkout@v4
with:
submodules: true

- name: Set up QEMU
uses: docker/setup-qemu-action@v1
- name: Build
uses: docker/build-push-action@v2
uses: docker/setup-qemu-action@v3

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Build image for testing
uses: docker/build-push-action@v6
with:
context: .
platforms: linux/${{ matrix.arch }}
load: true
tags: |
fedorapython/fedora-python-tox:${{ matrix.arch }}
fedorapython/fedora-python-tox:${{ matrix.arch }}-f${{ env.FEDORA_VERSION }}
fedorapython/fedora-python-tox:test-${{ matrix.arch }}

- name: Test local project
env:
TOXENV: ${{ matrix.toxenv }}
run: |
docker run --rm --platform linux/${{ matrix.arch }} -v $PWD/example_project:/src -w /src -e TOXENV fedorapython/fedora-python-tox:${{ matrix.arch }}
docker run --rm --platform linux/${{ matrix.arch }} -v $PWD/example_project:/src -w /src -e TOXENV fedorapython/fedora-python-tox:test-${{ matrix.arch }}

- name: Test remote project
env:
TOXENV: ${{ matrix.toxenv }}
run: |
docker run --rm --platform linux/${{ matrix.arch }} -e TOXENV -e GIT_URL=https://github.com/frenzymadness/python-tox-example.git fedorapython/fedora-python-tox:${{ matrix.arch }}
docker run --rm --platform linux/${{ matrix.arch }} -e TOXENV -e GIT_URL=https://github.com/frenzymadness/python-tox-example.git fedorapython/fedora-python-tox:test-${{ matrix.arch }}

- name: Test parallel run
env:
TOXENV: ${{ matrix.toxenv }}
run: |
docker run --rm --platform linux/${{ matrix.arch }} -v $PWD/example_project:/src -w /src -e TOXENV -e TOX_PARAMS="-p auto" fedorapython/fedora-python-tox:${{ matrix.arch }}
docker run --rm --platform linux/${{ matrix.arch }} -v $PWD/example_project:/src -w /src -e TOXENV -e TOX_PARAMS="-p auto" fedorapython/fedora-python-tox:test-${{ matrix.arch }}

- name: Test dnf install and wheel build
env:
TOXENV: ${{ matrix.toxenv }}
run: |
docker run --rm --platform linux/${{ matrix.arch }} -e DNF_INSTALL="libffi-devel 'pkgconfig(libgit2) >= 1.9' /usr/bin/cowsay" fedorapython/fedora-python-tox:${{ matrix.arch }} sh -c "/run_tests.sh; pip install -I --no-deps --compile --no-binary :all: cffi pygit2~=1.17.0 && cowsay DONE"
docker run --rm --platform linux/${{ matrix.arch }} -e DNF_INSTALL="libffi-devel 'pkgconfig(libgit2) >= 1.9' /usr/bin/cowsay" fedorapython/fedora-python-tox:test-${{ matrix.arch }} sh -c "/run_tests.sh; pip install -I --no-deps --compile --no-binary :all: cffi pygit2~=1.17.0 && cowsay DONE"

- name: Test external project with WORKDIR
run: |
docker run --rm --platform linux/${{ matrix.arch }} -e TOXENV=py3 -e GIT_URL=https://github.com/frenzymadness/nflxprofile.git -e WORKDIR=python fedorapython/fedora-python-tox:${{ matrix.arch }}
docker run --rm --platform linux/${{ matrix.arch }} -e TOXENV=py3 -e GIT_URL=https://github.com/frenzymadness/nflxprofile.git -e WORKDIR=python fedorapython/fedora-python-tox:test-${{ matrix.arch }}

- name: Login to DockerHub
uses: docker/login-action@v1
if: github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Push to Dockerhub
uses: docker/build-push-action@v2

- name: Build and push platform-specific images
if: github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
uses: docker/build-push-action@v6
with:
context: .
platforms: linux/${{ matrix.arch }}
Expand All @@ -85,61 +96,57 @@ jobs:
fedorapython/fedora-python-tox:${{ matrix.arch }}
fedorapython/fedora-python-tox:${{ matrix.arch }}-f${{ env.FEDORA_VERSION }}

description_update:
name: 'Update Dockerhub description'
if: github.event_name == 'push'
needs: build-and-push
release:
name: Create multi-platform manifests
if: github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
needs: build-and-test
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: 'Update Dockerhub description'
uses: peter-evans/dockerhub-description@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Login to DockerHub
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
repository: fedorapython/fedora-python-tox

release:
name: 'Update and test manifests'
if: github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
needs: build-and-push
- name: Create and push multi-platform manifest for :latest
run: |
docker buildx imagetools create -t fedorapython/fedora-python-tox:latest \
fedorapython/fedora-python-tox:amd64 \
fedorapython/fedora-python-tox:arm64 \
fedorapython/fedora-python-tox:ppc64le \
fedorapython/fedora-python-tox:s390x

- name: Create and push multi-platform manifest for :f${{ env.FEDORA_VERSION }}
run: |
docker buildx imagetools create -t fedorapython/fedora-python-tox:f${{ env.FEDORA_VERSION }} \
fedorapython/fedora-python-tox:amd64-f${{ env.FEDORA_VERSION }} \
fedorapython/fedora-python-tox:arm64-f${{ env.FEDORA_VERSION }} \
fedorapython/fedora-python-tox:ppc64le-f${{ env.FEDORA_VERSION }} \
fedorapython/fedora-python-tox:s390x-f${{ env.FEDORA_VERSION }}

- name: Verify :latest manifest
run: |
docker buildx imagetools inspect fedorapython/fedora-python-tox:latest

- name: Verify :f${{ env.FEDORA_VERSION }} manifest
run: |
docker buildx imagetools inspect fedorapython/fedora-python-tox:f${{ env.FEDORA_VERSION }}

description_update:
name: Update Dockerhub description
if: github.event_name == 'push'
needs: release
runs-on: ubuntu-latest
steps:
- name: Login to DockerHub
uses: docker/login-action@v1
- name: Checkout
uses: actions/checkout@v4

- name: Update Dockerhub description
uses: peter-evans/dockerhub-description@v4
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Pull all images
run: >
for arch in amd64 arm64 ppc64le s390x; do
docker pull fedorapython/fedora-python-tox:$arch;
docker pull fedorapython/fedora-python-tox:${arch}-f${{ env.FEDORA_VERSION }};
done
- name: Create and push manifest for the :latest tag
env:
DOCKER_CLI_EXPERIMENTAL: enabled
run: >
docker manifest create fedorapython/fedora-python-tox:latest
fedorapython/fedora-python-tox:amd64
fedorapython/fedora-python-tox:arm64
fedorapython/fedora-python-tox:ppc64le
fedorapython/fedora-python-tox:s390x;
docker manifest push fedorapython/fedora-python-tox:latest;
- name: Test the latest manifest
run: |
docker manifest inspect fedorapython/fedora-python-tox:latest | grep '"architecture":' | grep -Ez '(.*(amd64|arm64|ppc64le|s390x).*){4}'
- name: Create and push manifest for the versioned tag
env:
DOCKER_CLI_EXPERIMENTAL: enabled
run: >
docker manifest create fedorapython/fedora-python-tox:f${{ env.FEDORA_VERSION }}
fedorapython/fedora-python-tox:amd64-f${{ env.FEDORA_VERSION }}
fedorapython/fedora-python-tox:arm64-f${{ env.FEDORA_VERSION }}
fedorapython/fedora-python-tox:ppc64le-f${{ env.FEDORA_VERSION }}
fedorapython/fedora-python-tox:s390x-f${{ env.FEDORA_VERSION }};
docker manifest push fedorapython/fedora-python-tox:f${{ env.FEDORA_VERSION }};
- name: Test the versioned manifest
run: |
docker manifest inspect fedorapython/fedora-python-tox:f${{ env.FEDORA_VERSION }} | grep '"architecture":' | grep -Ez '(.*(amd64|arm64|ppc64le|s390x).*){4}'
repository: fedorapython/fedora-python-tox