build.yml

name: Build

# Reusable workflow: builds every image in apko/, tests and scans it natively on x86_64 and aarch64
# and, when `publish` is set, publishes the images that changed.
#
# For each image:
#   test     (per architecture, native runner) apko build, image tests, OpenSCAP scan against the
#            STIG profile from the Wolfi package chainguard-security-guide (DISA GPOS SRG), Grype scan.
#   publish  apko builds both architectures into a local staging registry. The build is
#            reproducible, so each platform manifest must have exactly the digest that was tested.
#            If the result equals the image already published under the floating tag, nothing
#            changed and nothing is published. Otherwise it is copied to GHCR by digest, without a
#            tag, signed, attested (SBOM, STIG results, vulnerability scan, SLSA provenance) and
#            verified, and only then tagged. A release tag therefore never exists without its
#            evidence, and a failed run leaves only untagged manifests, which the cleanup deletes.
#
# SLSA Build Level 3: building, signing and attesting run inside this reusable workflow, whose
# identity (job_workflow_ref) signs the provenance; callers can only pass `publish`.
on:
  workflow_call:
    inputs:
      publish:
        description: Publish, sign and attest the images that changed
        type: boolean
        default: false
    outputs:
      images:
        description: JSON list of the images (scripts/plan.py)
        value: ${{ jobs.plan.outputs.images }}

permissions:
  contents: read

jobs:
  # Discovers the images to build from apko/python-*.apko.yaml
  plan:
    name: plan
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      images: ${{ steps.plan.outputs.images }}
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Plan
        id: plan
        run: echo "images=$(python3 scripts/plan.py "ghcr.io/${GITHUB_REPOSITORY,,}")" >> "$GITHUB_OUTPUT"

  # Packages built here by melange (melange/*.yaml), natively on each architecture: Python LTS
  # compiled from official python.org source tarballs. Signed with the MELANGE_SIGNING_KEY secret,
  # whose public half is keys/python-packages.rsa.pub; apko puts that public key in the images.
  packages:
    name: packages (${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 60
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: x86_64
            runner: ubuntu-latest
          - arch: aarch64
            runner: ubuntu-24.04-arm
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Install cosign
        uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
        with:
          cosign-release: v3.1.4

      - name: Install melange
        run: |
          scripts/install-tools.sh "$RUNNER_TEMP/bin" melange
          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"

      # Releases must be signed with the published key; pull requests without access to the secret
      # (forks) sign with a throwaway key of the same name and are never published
      - name: Signing Key
        env:
          SIGNING_KEY: ${{ secrets.MELANGE_SIGNING_KEY }}
        run: |
          mkdir -p .keys
          if [ -n "$SIGNING_KEY" ]; then
            (umask 077; printf '%s\n' "$SIGNING_KEY" > .keys/python-packages.rsa)
            openssl rsa -in .keys/python-packages.rsa -traditional -out .keys/python-packages.rsa
            cp keys/python-packages.rsa.pub .keys/python-packages.rsa.pub
            openssl pkey -in .keys/python-packages.rsa -pubout | diff -q - .keys/python-packages.rsa.pub
          elif [ "${{ inputs.publish }}" = true ]; then
            echo "::error::Releases need the MELANGE_SIGNING_KEY secret"
            exit 1
          else
            (cd .keys && melange keygen python-packages.rsa)
          fi

      - name: Build and Test
        run: |
          for recipe in melange/*.yaml; do
            name="$(basename "$recipe" .yaml)"
            if grep -rqE "^\s*-\s+${name}(=|\b)" apko/; then
              echo "==> Building package $name"
              melange build "$recipe" --runner docker --arch "${{ matrix.arch }}" \
                --source-dir "melange/$name" --signing-key .keys/python-packages.rsa --out-dir packages
              melange test "$recipe" --runner docker --arch "${{ matrix.arch }}" \
                --source-dir "melange/$name" --repository-append "$PWD/packages" \
                --keyring-append "$PWD/.keys/python-packages.rsa.pub"
            else
              echo "==> Skipping $name (not referenced in apko/)"
            fi
          done
          cp .keys/python-packages.rsa.pub packages/
          rm -rf .keys
          ls -lR packages

      - name: Upload
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: packages-${{ matrix.arch }}
          path: packages
          if-no-files-found: error
          retention-days: 1

  # Builds one image for one architecture, runs tests, OpenSCAP and Grype
  test:
    name: test (${{ matrix.image.family }}, ${{ matrix.arch.name }})
    needs: [plan, packages]
    runs-on: ${{ matrix.arch.runner }}
    timeout-minutes: 45
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        image: ${{ fromJSON(needs.plan.outputs.images) }}
        arch:
          - { name: x86_64, runner: ubuntu-latest }
          - { name: aarch64, runner: ubuntu-24.04-arm }
    env:
      CONFIG: ${{ matrix.image.config }}
      FAMILY: ${{ matrix.image.family }}
      FLAVOR: ${{ matrix.image.flavor }}
      ARCH: ${{ matrix.arch.name }}
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Install cosign
        uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
        with:
          cosign-release: v3.1.4

      # apko from its GitHub release, verified (scripts/install-tools.sh)
      - name: Install apko
        run: |
          scripts/install-tools.sh "$RUNNER_TEMP/bin" apko
          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"

      - name: Download Packages
        if: matrix.image.local
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: packages-${{ matrix.arch.name }}
          path: packages

      # The OpenSCAP scanner, built from Wolfi packages (scanner/stig-scanner.apko.yaml)
      - name: Build the STIG Scanner
        run: |
          apko build scanner/stig-scanner.apko.yaml stig-scanner:local "$RUNNER_TEMP/scanner.tar" \
            --arch "$ARCH" --sbom=false
          echo "OPENSCAP_IMAGE=$(docker load -i "$RUNNER_TEMP/scanner.tar" | sed -n 's/^Loaded image: //p')" >> "$GITHUB_ENV"

      - name: Build
        run: |
          mkdir -p out/sbom results
          local_repo=()
          if [ "${{ matrix.image.local }}" = true ]; then
            local_repo=(-b "$PWD/packages" -k "$PWD/packages/python-packages.rsa.pub")
          fi
          apko build "$CONFIG" "test:$FAMILY" "${local_repo[@]}" \
            out/image.tar --arch "$ARCH" --vcs=false \
            --annotations "org.opencontainers.image.source:${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" \
            --sbom-path out/sbom
          ref="$(docker load -i out/image.tar | sed -n 's/^Loaded image: //p')"
          digest="$(tar -xOf out/image.tar index.json | jq -r '.manifests[0].digest')"
          py_ver="$(docker run --rm "$ref" --version 2>&1 | awk '{print $2}' || true)"
          echo "REF=$ref" >> "$GITHUB_ENV"
          # The installed packages, as recorded by apk in the image (the same list as the SBOM)
          cid="$(docker create "$ref" python3 -c "exit()" 2>/dev/null || docker create "$ref" true 2>/dev/null || docker create "$ref")"
          docker cp "$cid:/usr/lib/apk/db/installed" - | tar -xO \
            | awk -F: '/^P:/{p=$2} /^V:/{print p" "$2}' | sort > results/packages.txt
          docker rm "$cid" >/dev/null
          # Download size: the compressed layers; installed size: the unpacked image
          compressed="$(tar -tvf out/image.tar | awk '/\.tar\.gz$/ {s += $3} END {print s + 0}')"
          installed="$(docker image inspect "$ref" --format '{{.Size}}')"
          jq -n --arg family "$FAMILY" --arg arch "$ARCH" --arg digest "$digest" --arg python "$py_ver" \
            --argjson packages "$(wc -l < results/packages.txt)" \
            --argjson compressed "$compressed" --argjson installed "$installed" \
            --argjson spdx "$(jq '.packages | length' "out/sbom/sbom-$ARCH.spdx.json")" \
            '{family: $family, arch: $arch, digest: $digest, python: $python, packages: $packages,
              sbom_spdx_packages: $spdx, size: {compressed: $compressed, installed: $installed}}' \
            > results/image.json
          cat results/image.json
          cp "out/sbom/sbom-$ARCH.spdx.json" results/sbom.spdx.json

      - name: Test
        run: scripts/test-image.sh "$REF" "$FLAVOR"

      - name: STIG Scan (OpenSCAP)
        run: scripts/stig-scan.sh "$REF" results/stig

      - name: Vulnerability Scan (Grype)
        run: scripts/vuln-scan.sh "$REF" results/vuln

      - name: Summary
        run: |
          {
            echo "### $FAMILY ($ARCH): Python $(jq -r .python results/image.json)"
            jq -r '"SBOM: **\(.packages) packages** (\(.sbom_spdx_packages) SPDX entries). Size: \(.size.compressed / 1048576 | floor) MB compressed, \(.size.installed / 1048576 | floor) MB installed"' results/image.json
            echo
            jq -r '"STIG (\(.profile)): **\(.counts.pass // 0) of \(.applicable) applicable rules pass (\(.score)%)**, \(.counts.notapplicable // 0) not applicable"' results/stig/summary.json
            echo
            jq -r '.failed[] | "- \(.rule): \(.title)"' results/stig/summary.json
            echo
            jq -r '"Vulnerabilities (Grype): \(.total) total; Critical \(.counts.Critical), High \(.counts.High), Medium \(.counts.Medium), Low \(.counts.Low)"' results/vuln/summary.json
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Upload
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: results-${{ matrix.image.family }}-${{ matrix.arch.name }}
          path: results
          if-no-files-found: error
          retention-days: 7

  # Each image is published on its own: an image whose tests failed is skipped (its results were not
  # uploaded), and does not hold back the others. The run itself still fails, so the failure shows.
  publish:
    name: publish (${{ matrix.image.family }})
    needs: [plan, packages, test]
    if: ${{ !cancelled() && inputs.publish && needs.plan.result == 'success' }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    strategy:
      fail-fast: false
      matrix:
        image: ${{ fromJSON(needs.plan.outputs.images) }}
    services:
      # Staging registry on the runner: apko publishes here, and the result is copied to GHCR by digest
      staging:
        image: registry:3
        ports:
          - 5000:5000
    env:
      CONFIG: ${{ matrix.image.config }}
      IMAGE: ${{ matrix.image.image }}
      FAMILY: ${{ matrix.image.family }}
      FLAVOR: ${{ matrix.image.flavor }}
      LATEST: ${{ matrix.image.latest }}
      STAGED: localhost:5000/python
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Install oras
        uses: oras-project/setup-oras@5e2f2482b30b0cb3e14e67f89a80c88c659a7c63 # v2.0.3
        with:
          version: 1.3.6

      - name: Install cosign
        uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
        with:
          cosign-release: v3.1.4

      - name: Install apko
        run: |
          scripts/install-tools.sh "$RUNNER_TEMP/bin" apko
          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"

      - name: Download Packages
        if: matrix.image.local
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: packages-*
          path: packages
          merge-multiple: true

      - name: Download Test Results
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          pattern: results-${{ matrix.image.family }}-*
          path: results

      # Results are uploaded only when the tests and scans of that architecture passed
      - name: Tested on Both Architectures
        id: tested
        run: |
          for arch in x86_64 aarch64; do
            if [ ! -f "results/results-$FAMILY-$arch/image.json" ]; then
              echo "::warning::$FAMILY did not pass its tests on $arch; not publishing it"
              echo "ok=false" >> "$GITHUB_OUTPUT"
              exit 0
            fi
          done
          echo "ok=true" >> "$GITHUB_OUTPUT"

      - name: Log in to GHCR
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          printf '%s' "$GH_TOKEN" | oras login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
          printf '%s' "$GH_TOKEN" | cosign login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
          printf '%s' "$GH_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin

      - name: Build Both Architectures
        id: build
        if: steps.tested.outputs.ok == 'true'
        run: |
          mkdir -p out/sbom
          local_repo=()
          if [ "${{ matrix.image.local }}" = true ]; then
            local_repo=(-b "$PWD/packages" -k "$PWD/packages/python-packages.rsa.pub")
          fi
          apko publish "$CONFIG" "$STAGED:staging" "${local_repo[@]}" --arch x86_64,aarch64 --vcs=false \
            --annotations "org.opencontainers.image.source:${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" \
            --sbom-path out/sbom --image-refs out/refs.txt
          index="$(tail -n1 out/refs.txt | sed 's/.*@//')"
          echo "index=$index" >> "$GITHUB_OUTPUT"
          oras manifest fetch --plain-http "$STAGED@$index" > out/index.json
          jq -r '.manifests[] | "\(.platform.architecture) \(.digest)"' out/index.json

      # The build is reproducible: the images published here must be byte for byte the ones tested
      - name: Check Against the Tested Images
        if: steps.tested.outputs.ok == 'true'
        env:
          INDEX: ${{ steps.build.outputs.index }}
        run: |
          declare -A platform=([x86_64]=amd64 [aarch64]=arm64)
          for arch in x86_64 aarch64; do
            tested="$(jq -r .digest "results/results-$FAMILY-$arch/image.json")"
            built="$(jq -r --arg p "${platform[$arch]}" '.manifests[] | select(.platform.architecture == $p) | .digest' out/index.json)"
            echo "$arch: tested $tested, built $built"
            if [ "$tested" != "$built" ]; then
              echo "::error::$FAMILY $arch differs from the image that was tested"
              exit 1
            fi
          done

      - name: Check for Changes
        id: changed
        if: steps.tested.outputs.ok == 'true'
        env:
          INDEX: ${{ steps.build.outputs.index }}
        run: |
          current="$(oras resolve "$IMAGE:$FAMILY" 2>/dev/null || true)"
          echo "current=$current" >> "$GITHUB_OUTPUT"
          if [ "$current" = "$INDEX" ]; then
            echo "::notice::$IMAGE:$FAMILY is unchanged ($INDEX); nothing to publish"
            echo "changed=false" >> "$GITHUB_OUTPUT"
          else
            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Tags
        id: tags
        if: steps.tested.outputs.ok == 'true'
        run: |
          py_ver="$(jq -r .python "results/results-$FAMILY-x86_64/image.json")"
          suffix=""; [ "$FLAVOR" = dev ] && suffix="-dev"
          release="${py_ver}${suffix}-$(date -u +%Y%m%d).${GITHUB_RUN_NUMBER}"
          floating="$FAMILY ${py_ver}${suffix}"
          [ "$LATEST" = true ] && floating="$floating latest${suffix}"
          echo "release=$release" >> "$GITHUB_OUTPUT"
          echo "floating=$floating" >> "$GITHUB_OUTPUT"
          echo "release tag $release, floating tags $floating"

      # Unchanged image: no new release, but the floating tags must still point to it. This moves
      # `latest` when LATEST_MAJOR changes, and repairs a floating tag that an interrupted run missed.
      - name: Sync Floating Tags
        if: steps.changed.outputs.changed == 'false'
        env:
          CURRENT: ${{ steps.changed.outputs.current }}
          FLOATING: ${{ steps.tags.outputs.floating }}
        run: |
          for tag in $FLOATING; do
            if [ "$(oras resolve "$IMAGE:$tag" 2>/dev/null || true)" != "$CURRENT" ]; then
              echo "moving $tag to $CURRENT"
              oras tag "$IMAGE@$CURRENT" "$tag"
            fi
          done

      - name: Push by Digest
        if: steps.changed.outputs.changed == 'true'
        env:
          INDEX: ${{ steps.build.outputs.index }}
        run: oras cp --from-plain-http "$STAGED@$INDEX" "$IMAGE@$INDEX"

      - name: Sign
        if: steps.changed.outputs.changed == 'true'
        run: cosign sign --yes --recursive "$IMAGE@${{ steps.build.outputs.index }}"

      # Per platform: the SPDX SBOM from apko, and the STIG and vulnerability results of the test job
      - name: Attest SBOMs and Scan Results
        if: steps.changed.outputs.changed == 'true'
        run: |
          base="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/attestations"
          for arch in x86_64 aarch64; do
            digest="$(jq -r .digest "results/results-$FAMILY-$arch/image.json")"
            cosign attest --yes --type spdxjson --predicate "out/sbom/sbom-$arch.spdx.json" "$IMAGE@$digest"
            cosign attest --yes --type "$base/stig/v1" \
              --predicate "results/results-$FAMILY-$arch/stig/summary.json" "$IMAGE@$digest"
            cosign attest --yes --type "$base/vulnerabilities/v1" \
              --predicate "results/results-$FAMILY-$arch/vuln/summary.json" "$IMAGE@$digest"
          done

      - name: Attest Provenance
        if: steps.changed.outputs.changed == 'true'
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-name: ${{ matrix.image.image }}
          subject-digest: ${{ steps.build.outputs.index }}
          push-to-registry: true

      - name: Verify
        if: steps.changed.outputs.changed == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          INDEX: ${{ steps.build.outputs.index }}
        run: |
          identity="^${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/.github/workflows/build.yml@"
          issuer=https://token.actions.githubusercontent.com
          cosign verify "$IMAGE@$INDEX" --certificate-identity-regexp "$identity" \
            --certificate-oidc-issuer "$issuer" >/dev/null
          for digest in $(jq -r '.manifests[].digest' out/index.json); do
            cosign verify "$IMAGE@$digest" --certificate-identity-regexp "$identity" \
              --certificate-oidc-issuer "$issuer" >/dev/null
            cosign verify-attestation --type spdxjson "$IMAGE@$digest" \
              --certificate-identity-regexp "$identity" --certificate-oidc-issuer "$issuer" >/dev/null
          done
          gh attestation verify "oci://$IMAGE@$INDEX" --repo "$GITHUB_REPOSITORY" \
            --signer-workflow "$GITHUB_REPOSITORY/.github/workflows/build.yml"
          oras discover --format tree "$IMAGE@$INDEX"

      # Packages added, removed and updated since the image under the floating tag
      - name: Changes Since the Last Release
        if: steps.changed.outputs.changed == 'true'
        env:
          INDEX: ${{ steps.build.outputs.index }}
          CURRENT: ${{ steps.changed.outputs.current }}
        run: |
          packages() {
            local cid; cid="$(docker create --platform linux/amd64 "$1" true 2>/dev/null || docker create --platform linux/amd64 "$1")"
            docker cp "$cid:/usr/lib/apk/db/installed" - | tar -xO | awk -F: '/^P:/{p=$2} /^V:/{print p" "$2}' | sort
            docker rm "$cid" >/dev/null
          }
          packages "$STAGED@$INDEX" > out/new.txt
          if [ -n "$CURRENT" ]; then packages "$IMAGE@$CURRENT" > out/old.txt; else : > out/old.txt; fi

      # Uploaded before the tags are created: if the run stops in between, a re-run finds the image
      # unchanged and publishes nothing, but this record lets the release job finish the release.
      # The release job only releases a record whose tag exists on the recorded digest.
      - name: Release Record
        if: steps.changed.outputs.changed == 'true'
        env:
          INDEX: ${{ steps.build.outputs.index }}
          RELEASE: ${{ steps.tags.outputs.release }}
          FLOATING: ${{ steps.tags.outputs.floating }}
        run: |
          mkdir -p record
          python3 scripts/release.py record out/old.txt out/new.txt results > record/record.json
          for arch in x86_64 aarch64; do
            cp "results/results-$FAMILY-$arch/stig/report.html" "record/stig-$arch.html"
            cp "out/sbom/sbom-$arch.spdx.json" "record/sbom-$arch.spdx.json"
          done
          jq . record/record.json

      - name: Upload Release Record
        if: steps.changed.outputs.changed == 'true'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-${{ matrix.image.family }}
          path: record
          if-no-files-found: error
          retention-days: 1

      # Unchanged image: no release, but its status (today's vulnerability scan, the profile results,
      # the SBOM) is refreshed on the status pages and badges, since new CVEs appear every day
      - name: Status Record
        if: steps.changed.outputs.changed == 'false'
        env:
          CURRENT: ${{ steps.changed.outputs.current }}
          FLOATING: ${{ steps.tags.outputs.floating }}
        run: |
          major="${FAMILY%%-*}"
          if [ "$FLAVOR" = dev ]; then
            re="^${major}\.[0-9]+-dev-[0-9]{8}\.[0-9]+\$"
          else
            re="^${major}\.[0-9]+-[0-9]{8}\.[0-9]+\$"
          fi
          release=""
          for tag in $(oras repo tags "$IMAGE" | grep -E "$re" | sort -r); do
            if [ "$(oras resolve "$IMAGE:$tag")" = "$CURRENT" ]; then release="$tag"; break; fi
          done
          if [ -z "$release" ]; then
            echo "::warning::no release tag found on $CURRENT; status not refreshed"
            exit 0
          fi
          cp "results/results-$FAMILY-x86_64/packages.txt" out/same.txt
          mkdir -p status
          INDEX="$CURRENT" RELEASE="$release" python3 scripts/release.py record out/same.txt out/same.txt results > status/record.json
          for arch in x86_64 aarch64; do
            cp "results/results-$FAMILY-$arch/stig/report.html" "status/stig-$arch.html"
            cp "out/sbom/sbom-$arch.spdx.json" "status/sbom-$arch.spdx.json"
          done
          echo "status of $IMAGE:$release refreshed"

      - name: Upload Status Record
        if: steps.changed.outputs.changed == 'false'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: status-${{ matrix.image.family }}
          path: status
          if-no-files-found: ignore
          retention-days: 1

      # Last step: the tags appear only on a published, signed, attested and verified digest
      - name: Tag
        if: steps.changed.outputs.changed == 'true'
        run: oras tag "$IMAGE@${{ steps.build.outputs.index }}" "${{ steps.tags.outputs.release }}" ${{ steps.tags.outputs.floating }}