From ab8c8f95ab2f04423e1c37c42dad317302ef4cb9 Mon Sep 17 00:00:00 2001
From: Jim Martens <github@2martens.de>
Date: Fri, 3 Oct 2025 11:43:11 +0200
Subject: [PATCH] fix: Add attestations for each architecture

---
 .github/workflows/docker-image.yaml | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/docker-image.yaml b/.github/workflows/docker-image.yaml
index 879432a..8c18a4c 100644
--- a/.github/workflows/docker-image.yaml
+++ b/.github/workflows/docker-image.yaml
@@ -48,7 +48,14 @@ jobs:
         id: digest
         run: |
           DIGEST_FILE=${{ github.workspace }}/module-deploy/build/jib-image.digest
-          echo "digest=$(cat $DIGEST_FILE)" >> $GITHUB_OUTPUT
+          INDEX_DIGEST=$(cat $DIGEST_FILE)
+          echo "digest=$INDEX_DIGEST" >> $GITHUB_OUTPUT
+          ARCH_DIGESTS=$(docker manifest inspect 2martens/timetable@$INDEX_DIGEST | jq -r '.manifests[].digest')
+          n=0
+          for d in $ARCH_DIGESTS; do
+            echo "arch${n}=$d" >> $GITHUB_OUTPUT
+            n=$((n+1))
+          done
       - name: Perform docker login
         uses: docker/login-action@v3
         with:
@@ -62,3 +69,17 @@ jobs:
           subject-name: docker.io/2martens/timetable
           subject-digest: ${{ steps.digest.outputs.digest }}
           push-to-registry: true
+      - name: Attest first arch
+        uses: actions/attest-build-provenance@v3
+        id: attest
+        with:
+          subject-name: docker.io/2martens/timetable
+          subject-digest: ${{ steps.digest.outputs.arch0 }}
+          push-to-registry: true
+      - name: Attest second arch
+        uses: actions/attest-build-provenance@v3
+        id: attest
+        with:
+          subject-name: docker.io/2martens/timetable
+          subject-digest: ${{ steps.digest.outputs.arch1 }}
+          push-to-registry: true