From f5b68dc590fb526958bdf31506de3d356cb16804 Mon Sep 17 00:00:00 2001 From: Max Schmitt Date: Mon, 7 Jul 2025 23:08:12 +0200 Subject: [PATCH] devops(docker): enhance Docker image publishing with ORAS end-of-life tagging (#641) This tags the images we publish as EOL immediately in order to get excluded from the image scanning. Like we do upstream in microsoft/playwright. --- .github/workflows/publish.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 503702b..f581c2c 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -44,6 +44,7 @@ jobs: - name: Login to ACR run: az acr login --name playwright - name: Build and push Docker image + id: build-push uses: docker/build-push-action@v6 with: context: . @@ -53,3 +54,17 @@ jobs: tags: | playwright.azurecr.io/public/playwright/mcp:${{ github.event.release.tag_name }} playwright.azurecr.io/public/playwright/mcp:latest + - uses: oras-project/setup-oras@v1 + - name: Set oras tags + run: | + attach_eol_manifest() { + local image="$1" + local today=$(date -u +'%Y-%m-%d') + # oras is re-using Docker credentials, so we don't need to login. + # Following the advice in https://portal.microsofticm.com/imp/v3/incidents/incident/476783820/summary + oras attach --artifact-type application/vnd.microsoft.artifact.lifecycle --annotation "vnd.microsoft.artifact.lifecycle.end-of-life.date=$today" $image + } + # for each tag, attach the eol manifest + for tag in $(echo ${{ steps.build-push.outputs.metadata['image.name'] }} | tr ',' '\n'); do + attach_eol_manifest $tag + done