feat(docker-build): upload image tag as an artifact and publish summary (#163)

Author: jbern0rd

.github/workflows/docker-build.yml

@@ -90,6 +90,7 @@ jobs:
     env:
       PLATFORM: ${{ inputs.platform }}
       OCI_IMAGE: ${{ inputs.image-name }}:${{ inputs.image-tag }}
+      IMAGE_TAG: ${{ inputs.image-tag }}
       REPORT_MODE: ${{ inputs.security-report }}
 
     steps:
@@ -274,6 +275,19 @@ jobs:
         if: ${{ inputs.push }}
         run: docker push "$OCI_IMAGE"
 
+      - name: Record the pushed image tag
+        run: |
+          echo "$IMAGE_TAG" > image-tag.txt
+
+      # The promote workflow runs from a separate tag push and reads this artifact
+      # from the CI run, instead of reconstructing the tag from a prefix.
+      - name: Upload the image tag for the promote workflow
+        if: ${{ inputs.push }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: docker-image-tag
+          path: image-tag.txt
+
       - name: Compute checksum of the Docker image
         id: checksum
         run: |
@@ -283,6 +297,27 @@ jobs:
           echo "checksum=0x${DIGEST}" >> "$GITHUB_OUTPUT"
           echo "digest=sha256:${DIGEST}" >> "$GITHUB_OUTPUT"
 
+      - name: Summarise the build
+        env:
+          PUSH: ${{ inputs.push }}
+          REGISTRY: ${{ inputs.registry }}
+          DIGEST: ${{ steps.checksum.outputs.digest }}
+          CHECKSUM: ${{ steps.checksum.outputs.checksum }}
+        run: |
+          {
+            echo "### 🐳 Built \`$OCI_IMAGE\`"
+            echo ""
+            echo "<table><tbody>"
+            echo "<tr><td><b>Platform</b></td><td>$PLATFORM</td></tr>"
+            echo "<tr><td><b>Registry</b></td><td>$REGISTRY</td></tr>"
+            echo "<tr><td><b>Digest</b></td><td><code>$DIGEST</code></td></tr>"
+            echo "<tr><td><b>Checksum</b></td><td><code>$CHECKSUM</code></td></tr>"
+            if [ "$PUSH" = "true" ]; then
+              echo "<tr><td><b>Pushed</b></td><td>✅</td></tr>"
+            fi
+            echo "</tbody></table>"
+          } >> "$GITHUB_STEP_SUMMARY"
+
       # --- SLSA provenance attestation -----
       # Requires the permissions id-token: write + attestations: write.
       - name: Generate & sign SLSA provenance (keyless)
@@ -296,5 +331,5 @@ jobs:
       - name: Cleanup files
         if: always()
         run: |
-          rm -f trivy.txt trivy-results.sarif
+          rm -f trivy.txt trivy-results.sarif image-tag.txt
           docker image rm -f "$OCI_IMAGE"

docker-build/README.md

@@ -53,6 +53,14 @@ Perfect for teams looking to streamline their containerization workflow with min
 | `username`           | Username for Docker Registry authentication                                                         | When `push: true`  |
 | `password`           | Password or Personal Access Token for Docker registry authentication (with appropriate permissions) | When `push: true`  |
 
+## 📤 Outputs
+
+| Name | Description |
+| --- | --- |
+| `checksum` | Checksum (`0x...`) of the Docker image |
+
+The built image tag, digest and checksum are visible on the workflow run summary.
+
 ## 💻 Example Usage
 
 ```yaml
@@ -93,6 +101,7 @@ jobs:
 - 🔒 Ensure your Docker Registry credentials are stored securely as GitHub Secrets
 - 🔄 The workflow will automatically handle the Docker build and push process
 - 🏷️ You can specify any valid Docker tag format in the `tag` input
+- 📤 When `push: true`, the applied tag is also saved as a `docker-image-tag` artifact, so `docker-promote` can promote the exact image CI built for a commit rather than reconstruct its tag
 - 📅 Consider using dynamic tags based on git tags, commit SHAs, or dates
 - 🧪 For testing purposes, you can use the `--dry-run` flag in your own implementation
 - 📜 When `attest: true`, the attestation is only generated if `push: true`, and the **caller** workflow must grant the following permissions:

docker-build/workflow-sha256

@@ -1 +1 @@
-45cbab194c7027c476e38ea6b843d97121a99785a1406ae8584f10d150f538c3
+c1688238c51571ebf2755cee205def80d47878ca649d17f2f216b4d979d534fe