From ef6ea291d5ac7789a0632a5db75d95f51d7b7363 Mon Sep 17 00:00:00 2001
From: Christian Krakau-Louis <christianlouis@gmail.com>
Date: Fri, 28 Mar 2025 23:31:49 +0100
Subject: [PATCH] Update docker-build.yaml

---
 .github/workflows/docker-build.yaml | 37 +++++++++++++++++++----------
 1 file changed, 25 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/docker-build.yaml b/.github/workflows/docker-build.yaml
index c66c2e66..8cd7c1c9 100644
--- a/.github/workflows/docker-build.yaml
+++ b/.github/workflows/docker-build.yaml
@@ -16,8 +16,11 @@ on:
     branches:
       - main
 
+env:
+  IMAGE_NAME: christianlouis/document-processor
+
 jobs:
-  build:
+  docker:
     runs-on: ubuntu-latest
 
     steps:
@@ -25,16 +28,16 @@ jobs:
         uses: actions/checkout@v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -44,19 +47,29 @@ jobs:
         if: startsWith(github.ref, 'refs/tags/')
         run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
 
-      - name: Build and Push Docker Image
-        uses: docker/build-push-action@v4
+      - name: Extract metadata for tags
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ env.IMAGE_NAME }}
+            ghcr.io/${{ github.repository_owner }}/document-processor
+
+      - name: Build and Push Docker Image with Provenance and SBOM
+        uses: docker/build-push-action@v6
         with:
-          platforms: linux/amd64
           context: .
           file: Dockerfile
+          platforms: linux/amd64
           push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          sbom: true
+          provenance: mode=max
           tags: |
-            christianlouis/document-processor:latest
-            christianlouis/document-processor:${{ github.sha }}
+            ${{ env.IMAGE_NAME }}:latest
+            ${{ env.IMAGE_NAME }}:${{ github.sha }}
             ghcr.io/${{ github.repository_owner }}/document-processor:latest
             ghcr.io/${{ github.repository_owner }}/document-processor:${{ github.sha }}
-            ${{ startsWith(github.ref, 'refs/tags/') && format('christianlouis/document-processor:{0}', env.VERSION) || '' }}
+            ${{ startsWith(github.ref, 'refs/tags/') && format('{0}:{1}', env.IMAGE_NAME, env.VERSION) || '' }}
             ${{ startsWith(github.ref, 'refs/tags/') && format('ghcr.io/{0}/document-processor:{1}', github.repository_owner, env.VERSION) || '' }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max