build: Improve OCI packaging and delivery

Signed-off-by: Thomas Vitale <[email protected]>

.github/workflows/multi-arch-publish.yml

@@ -96,11 +96,10 @@ jobs:
       contents: read
       packages: write
       id-token: write
+    outputs:
+      image-digest: ${{ steps.image-info.outputs.digest }}
+      image-name: ${{ steps.image-info.outputs.name }}
     steps:
-      - name: Prepare
-        run: |
-          timestamp=$(date +%Y%m%d)
-          echo "TIMESTAMP=${timestamp}" >> $GITHUB_ENV
 
       - name: Download digests
         uses: actions/download-artifact@v4
@@ -121,14 +120,14 @@ jobs:
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE }}
           labels: |
-            org.opencontainers.image.licenses='Apache-2.0'
+            org.opencontainers.image.licenses=Apache-2.0
             org.opencontainers.image.revision=${{ github.sha }}
             org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
             org.opencontainers.image.version=${{ github.sha }}
             org.opencontainers.image.url=${{ github.server_url }}/${{ github.repository }}
           tags: |
             type=raw,value=latest,enable={{is_default_branch}}
-            type=raw,value=${{ env.TIMESTAMP }},enable={{is_default_branch}}
+            type=schedule,pattern={{date 'YYYYMMDD'}}
             type=sha,format=long
 
       - name: Login to container registry
@@ -148,6 +147,31 @@ jobs:
         run: |
           docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ steps.meta.outputs.version }}
       
+      - name: Get OCI image info
+        id: image-info
+        run: |
+          image_reference=$(docker inspect --format='{{index .RepoDigests 0}}' ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ steps.meta.outputs.version }})
+          echo $image_reference
+          image_digest=$(echo "$image_reference" | awk -F '@' '{print $2}')
+          echo $image_digest
+          echo "IMAGE_DIGEST=${image_digest}" >> $GITHUB_ENV
+          echo "digest=${image_digest}" >> $GITHUB_OUTPUT
+          echo "name=${REGISTRY}/${IMAGE}" >> $GITHUB_OUTPUT
+
       - name: Sign image
         run: |
-          cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ steps.meta.outputs.version }}
+          cosign sign --yes "${REGISTRY}/${IMAGE}@${IMAGE_DIGEST}"
+
+  # provenance:
+  #   needs: [merge]
+  #   permissions:
+  #     actions: read
+  #     id-token: write
+  #     packages: write
+  #   uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
+  #   with:
+  #     image: ${{ needs.build.outputs.image-name }}
+  #     digest: ${{ needs.build.outputs.image-digest }}
+  #     registry-username: ${{ github.actor }}
+  #   secrets:
+  #     registry-password: ${{ secrets.push-token }}