container-image workflow: Don't push attestations to image registries

Without further investigation, this only seems to push the image with the
digest as a tag, which only pollutes the registry.
This commit is contained in:
Eric Lippmann 2025-04-01 09:47:21 +02:00 committed by Yonas Habteab
parent 678656129a
commit 4e4347072b

View File

@ -103,7 +103,7 @@ jobs:
with: with:
subject-name: ghcr.io/${{ env.IMAGE_NAME }} subject-name: ghcr.io/${{ env.IMAGE_NAME }}
subject-digest: ${{ steps.build-and-push.outputs.digest }} subject-digest: ${{ steps.build-and-push.outputs.digest }}
push-to-registry: true push-to-registry: false
- name: Generate artifact attestation for Docker Hub - name: Generate artifact attestation for Docker Hub
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request'
@ -115,4 +115,4 @@ jobs:
# [^1]: https://github.com/actions/attest-build-provenance?tab=readme-ov-file#container-image # [^1]: https://github.com/actions/attest-build-provenance?tab=readme-ov-file#container-image
subject-name: index.docker.io/${{ env.IMAGE_NAME }} subject-name: index.docker.io/${{ env.IMAGE_NAME }}
subject-digest: ${{ steps.build-and-push.outputs.digest }} subject-digest: ${{ steps.build-and-push.outputs.digest }}
push-to-registry: true push-to-registry: false