Attest Image (GH Container Registry) #2

	name: Attest Image (GH Container Registry)

	on:
	workflow_dispatch:

	jobs:
	build-artifact-ghcr:
	name: Build/Attest Artifact (GHCR)
	runs-on: ubuntu-latest
	permissions:
	id-token: write
	attestations: write
	packages: write
	env:
	REGISTRY: ghcr.io
	IMAGE_NAME: ${{ github.repository }}
	steps:
	- name: Build artifact
	run: date > artifact.bin

	- name: Build Dockerfile
	run: \|
	cat <<EOF > Dockerfile
	FROM scratch
	COPY artifact.bin .
	EOF

	- name: Set up QEMU
	uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0

	- name: Login to GHCR
	uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
	with:
	registry: ${{ env.REGISTRY }}
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	- name: Build and push
	id: build-and-push
	uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
	with:
	context: .
	platforms: 'linux/amd64,linux/arm64'
	push: true
	tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest

	- name: Attest artifact
	uses: actions/attest-build-provenance@49df96e17e918a15956db358890b08e61c704919 # v1.2.0
	with:
	subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
	subject-digest: ${{ steps.build-and-push.outputs.digest }}
	push-to-registry: true

	- name: Verify OCI image
	env:
	GH_TOKEN: ${{ github.token }}
	run: gh attestation verify oci://${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest --owner "$GITHUB_REPOSITORY_OWNER"

Provide feedback