Provenance issue with public repository
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 45/100
Research direction
Start with .github/workflows/publish.yml around line 176 and the pinned .github/workflows/build.yml at v1.6.0, then compare their build configuration with the working docker buildx command. Reproduce the workflow and inspect the resulting image with docker buildx imagetools; the issue is complete when the supported configuration or limitation is established and provenance behavior is documented or corrected.
Written by the indexing model from the issue text.
Description
Contributing guidelines
- I've read the contributing guidelines and wholeheartedly agree
I've found a bug, and:
- The documentation does not mention anything about my problem
- There are no open or closed issues that are related to my problem
Description
Hello,
My repository is public (https://github.com/nsphung/mcp-snowflake-server/blob/main/Dockerfile). And from my understanding, using docker/github-builder (docker/github-builder/.github/workflows/build.yml@7d2a02426d4b989616ba5aaee4e879afd4134b0d # v1.6.0), it should use docker/buildx provenance = mode=max,version=v1. But I don't have the expected results.
Expected behaviour
This is what I have without using docker/github-builder:
docker buildx imagetools inspect nsphung/mcp-snowflake-server-nsp:0.8.0 --format "{{ json .Provenance.SLSA }}"
# This one is working
This was build with:
docker buildx build \
--tag nsphung/mcp-snowflake-server-nsp:0.8.0 \
--sbom=true \
--attest type=provenance,mode=max,version=v1 \
.
Is there any way to have the same feature in docker/github-builder ? Or maybe I'm missing a configuration.
Actual behaviour
docker buildx imagetools inspect nsphung/mcp-snowflake-server-nsp:0.11.2 --format "{{ json .Provenance.SLSA }}"
null%
Here we can see null when inspecting for provenance.
Repository URL
https://github.com/nsphung/mcp-snowflake-server/tree/main
Workflow run URL
https://github.com/nsphung/mcp-snowflake-server/actions/runs/25457043001
YAML workflow
You can checkout the yaml at:
https://github.com/nsphung/mcp-snowflake-server/blob/main/.github/workflows/publish.yml#L176
Workflow logs
No response
BuildKit logs
Additional info
No response
- Dominant language
- No language data
- Stars
- 83
- Forks
- 23
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 8
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from docker/github-builder
-
kind/enhancement status/triage
Difficulty 3/5 1-2 days Newbie friendliness 52/100
docker/github-builder#282 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 52/100
docker/github-builder#251 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
docker/github-builder#209 ·
-
kind/enhancement
Difficulty 3/5 1-2 days Newbie friendliness 65/100
docker/github-builder#207 · 1 comment ·
-
kind/enhancement status/triage
Difficulty 5/5 Over a week Newbie friendliness 25/100
docker/github-builder#203 · 1 comment ·
All issues in docker/github-builder
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
NVIDIA/gpu-operator#2955 ·
-
agentic-workflows
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
automated issue report
Difficulty 1/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
dsx-ai-factory/infra-controller#6694 ·
-
bug build
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
facebookincubator/velox#19143 ·