fix: workflow permissions and add gitattributes #10

	name: Image

	on:
	push:
	branches: [ "main" ]
	paths:
	- recipe.yml
	- .github/workflows/image.yml
	workflow_dispatch:

	env:
	REGISTRY: ghcr.io
	IMAGE_NAME: dev-image

	jobs:
	image:
	runs-on: ubuntu-latest
	permissions:
	id-token: write
	contents: read
	packages: write
	attestations: write

	steps:
	- uses: actions/checkout@v4

	- uses: vanilla-os/[email protected]
	with:
	recipe: 'recipe.yml'

	- uses: actions/upload-artifact@v4
	with:
	name: Containerfile
	path: Containerfile

	- name: Login to GitHub Container Registry
	uses: docker/login-action@v3
	with:
	registry: ${{ env.REGISTRY }}
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	- name: Rename Containerfile to Dockerfile
	run: mv Containerfile Dockerfile

	- name: Build and push image
	id: push-ghcr
	uses: docker/[email protected]
	with:
	context: .
	push: true
	tags: ${{ env.REGISTRY }}/${{ github.actor }}/${{ env.IMAGE_NAME }}:main

	- uses: sigstore/[email protected]
	- name: Sign container image
	run: \|
	cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ env.REGISTRY }}/${{ github.actor }}/${{ env.IMAGE_NAME }}:main
	env:
	COSIGN_EXPERIMENTAL: false
	COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}

	- name: Attest pushed image
	uses: actions/attest-build-provenance@v1
	id: attest
	with:
	subject-name: ${{ env.REGISTRY }}/${{ github.actor }}/${{ env.IMAGE_NAME }}
	subject-digest: ${{ steps.push-ghcr.outputs.digest }}
	push-to-registry: true

Provide feedback