diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 17e0a7ba16..067a4fc263 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -1340,34 +1340,6 @@ jobs: with: subject-name: ghcr.io/coder/coder-preview subject-digest: ${{ steps.docker_digests.outputs.main_digest }} - predicate-type: "https://slsa.dev/provenance/v1" - predicate: | - { - "buildType": "https://github.com/actions/runner-images/", - "builder": { - "id": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" - }, - "invocation": { - "configSource": { - "uri": "git+https://github.com/${{ github.repository }}@${{ github.ref }}", - "digest": { - "sha1": "${{ github.sha }}" - }, - "entryPoint": ".github/workflows/ci.yaml" - }, - "environment": { - "github_workflow": "${{ github.workflow }}", - "github_run_id": "${{ github.run_id }}" - } - }, - "metadata": { - "buildInvocationID": "${{ github.run_id }}", - "completeness": { - "environment": true, - "materials": true - } - } - } push-to-registry: true - name: GitHub Attestation for Docker image (latest tag) @@ -1378,34 +1350,6 @@ jobs: with: subject-name: ghcr.io/coder/coder-preview subject-digest: ${{ steps.docker_digests.outputs.latest_digest }} - predicate-type: "https://slsa.dev/provenance/v1" - predicate: | - { - "buildType": "https://github.com/actions/runner-images/", - "builder": { - "id": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" - }, - "invocation": { - "configSource": { - "uri": "git+https://github.com/${{ github.repository }}@${{ github.ref }}", - "digest": { - "sha1": "${{ github.sha }}" - }, - "entryPoint": ".github/workflows/ci.yaml" - }, - "environment": { - "github_workflow": "${{ github.workflow }}", - "github_run_id": "${{ github.run_id }}" - } - }, - "metadata": { - "buildInvocationID": "${{ github.run_id }}", - "completeness": { - "environment": true, - "materials": true - } - } - } push-to-registry: true - name: GitHub Attestation for version-specific Docker image @@ -1416,34 +1360,6 @@ jobs: with: subject-name: ghcr.io/coder/coder-preview subject-digest: ${{ steps.docker_digests.outputs.version_digest }} - predicate-type: "https://slsa.dev/provenance/v1" - predicate: | - { - "buildType": "https://github.com/actions/runner-images/", - "builder": { - "id": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" - }, - "invocation": { - "configSource": { - "uri": "git+https://github.com/${{ github.repository }}@${{ github.ref }}", - "digest": { - "sha1": "${{ github.sha }}" - }, - "entryPoint": ".github/workflows/ci.yaml" - }, - "environment": { - "github_workflow": "${{ github.workflow }}", - "github_run_id": "${{ github.run_id }}" - } - }, - "metadata": { - "buildInvocationID": "${{ github.run_id }}", - "completeness": { - "environment": true, - "materials": true - } - } - } push-to-registry: true # Report attestation failures but don't fail the workflow diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 62fd93a4ce..d0ca5fe500 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -358,34 +358,6 @@ jobs: with: subject-name: ghcr.io/coder/coder-base subject-digest: ${{ steps.build_base_image.outputs.digest }} - predicate-type: "https://slsa.dev/provenance/v1" - predicate: | - { - "buildType": "https://github.com/actions/runner-images/", - "builder": { - "id": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" - }, - "invocation": { - "configSource": { - "uri": "git+https://github.com/${{ github.repository }}@${{ github.ref }}", - "digest": { - "sha1": "${{ github.sha }}" - }, - "entryPoint": ".github/workflows/release.yaml" - }, - "environment": { - "github_workflow": "${{ github.workflow }}", - "github_run_id": "${{ github.run_id }}" - } - }, - "metadata": { - "buildInvocationID": "${{ github.run_id }}", - "completeness": { - "environment": true, - "materials": true - } - } - } push-to-registry: true - name: Build Linux Docker images @@ -493,34 +465,6 @@ jobs: with: subject-name: ghcr.io/coder/coder subject-digest: ${{ steps.docker_digests.outputs.multiarch_digest }} - predicate-type: "https://slsa.dev/provenance/v1" - predicate: | - { - "buildType": "https://github.com/actions/runner-images/", - "builder": { - "id": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" - }, - "invocation": { - "configSource": { - "uri": "git+https://github.com/${{ github.repository }}@${{ github.ref }}", - "digest": { - "sha1": "${{ github.sha }}" - }, - "entryPoint": ".github/workflows/release.yaml" - }, - "environment": { - "github_workflow": "${{ github.workflow }}", - "github_run_id": "${{ github.run_id }}" - } - }, - "metadata": { - "buildInvocationID": "${{ github.run_id }}", - "completeness": { - "environment": true, - "materials": true - } - } - } push-to-registry: true - name: GitHub Attestation for "latest" Docker image @@ -531,34 +475,6 @@ jobs: with: subject-name: ghcr.io/coder/coder subject-digest: ${{ steps.docker_digests.outputs.latest_digest }} - predicate-type: "https://slsa.dev/provenance/v1" - predicate: | - { - "buildType": "https://github.com/actions/runner-images/", - "builder": { - "id": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" - }, - "invocation": { - "configSource": { - "uri": "git+https://github.com/${{ github.repository }}@${{ github.ref }}", - "digest": { - "sha1": "${{ github.sha }}" - }, - "entryPoint": ".github/workflows/release.yaml" - }, - "environment": { - "github_workflow": "${{ github.workflow }}", - "github_run_id": "${{ github.run_id }}" - } - }, - "metadata": { - "buildInvocationID": "${{ github.run_id }}", - "completeness": { - "environment": true, - "materials": true - } - } - } push-to-registry: true # Report attestation failures but don't fail the workflow