using generate-tag to define artifact names

Author: timbastin

.github/workflows/build-image.yml

@@ -97,39 +97,31 @@ jobs:
         path: ${{ inputs.image-destination-path }}
       if: inputs.disable-artifact-registry-as-image-store == false
 
-    # Calculate a tag name
-    # If the image input is provided, use it as the tag
-    # If the workflow is triggered by a tag, use the tag as the tag
-    # Otherwise built GitOps compatible tags. Fallback to the branch name, commit hash, and timestamp. Those tags are sortable and  unique.
+    # Calculate the image tag with the same generator used in GitLab CI.
     - name: Set IMAGE_TAG
-      run: |
-        if [ "${IMAGE}" != "" ]; then
-          IMAGE_TAG="${IMAGE}"
-        elif [[ "${GITHUB_REF}" == refs/tags/* ]]; then
-          if [ "${IMAGE_SUFFIX}" != "" ]; then
-            IMAGE_TAG="ghcr.io/${{ github.repository }}/${IMAGE_SUFFIX}:${GITHUB_REF#refs/tags/}"  
-          else
-            IMAGE_TAG="ghcr.io/${{ github.repository }}:${GITHUB_REF#refs/tags/}"  
-          fi
-
-        else
-          branch=${GITHUB_REF##*/}
-          sha=${GITHUB_SHA::8}
-          ts=$(date +%s)
-            if [ "${IMAGE_SUFFIX}" != "" ]; then
-              IMAGE_TAG="ghcr.io/${{ github.repository }}/${IMAGE_SUFFIX}:${branch}-${sha}-${ts}"
+      uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
+      with:
+        args: >
+          sh -c '
+            if [ -n "$IMAGE" ]; then
+              IMAGE_TAG="$IMAGE"
             else
-              IMAGE_TAG="ghcr.io/${{ github.repository }}:${branch}-${sha}-${ts}"
+              if [ -n "$IMAGE_SUFFIX" ]; then
+                IMAGE_PATH="ghcr.io/${GITHUB_REPOSITORY}/${IMAGE_SUFFIX}"
+              else
+                IMAGE_PATH="ghcr.io/${GITHUB_REPOSITORY}"
+              fi
+
+              devguard-scanner generate-tag --imagePath="$IMAGE_PATH" --ref="$GITHUB_REF_NAME" > image-tag-env.txt
+              IMAGE_TAG=$(grep '^IMAGE_TAG=' image-tag-env.txt | cut -d= -f2-)
             fi
-        fi
-
-        IMAGE_TAG=$(echo "$IMAGE_TAG" | tr '[:upper:]' '[:lower:]')
-        echo "$IMAGE_TAG" > image-tag.txt
 
-        # necessary for the kaniko job
-        echo "IMAGE_TAG=$(cat image-tag.txt)" >> $GITHUB_ENV
+            IMAGE_TAG=$(echo "$IMAGE_TAG" | tr "[:upper:]" "[:lower:]")
+            echo "$IMAGE_TAG" > image-tag.txt
+            echo "IMAGE_TAG=$(cat image-tag.txt)" >> "$GITHUB_ENV"
+          '
       env:
-        IMAGE_SUFFIX: ${{ inputs.image-suffix }}  
+        IMAGE_SUFFIX: ${{ inputs.image-suffix }}
         IMAGE: ${{ inputs.image }}
 
     - name: Upload to container registry

.github/workflows/build-nix-image.yml

@@ -153,9 +153,15 @@ jobs:
             --architecture='${{ inputs.arch }}' \
             >> image-tag-env.txt
           IMAGE_TAG=$(grep '^IMAGE_TAG=' image-tag-env.txt | cut -d= -f2-)
+          ARTIFACT_NAME=$(grep '^ARTIFACT_NAME=' image-tag-env.txt | cut -d= -f2-)
+          ARTIFACT_URL_ENCODED=$(grep '^ARTIFACT_URL_ENCODED=' image-tag-env.txt | cut -d= -f2-)
           echo "$IMAGE_TAG" > image-tag.txt
+          echo "$ARTIFACT_NAME" > artifact-purl.txt
+          echo "$ARTIFACT_URL_ENCODED" > artifact-purl-safe.txt
           echo "image_tag=$IMAGE_TAG" >> "$GITHUB_OUTPUT"
           echo "IMAGE_TAG=$IMAGE_TAG" >> "$GITHUB_ENV"
+          echo "ARTIFACT_NAME=$ARTIFACT_NAME" >> "$GITHUB_ENV"
+          echo "ARTIFACT_URL_ENCODED=$ARTIFACT_URL_ENCODED" >> "$GITHUB_ENV"
 
       - name: Upload image-tag artifact
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 - https://github.com/actions/upload-artifact/releases/tag/v4.6.2
@@ -172,13 +178,12 @@ jobs:
       - name: Set artifact PURL
         id: set-purl
         run: |
-          REGISTRY_AND_IMAGE=${IMAGE_TAG%:*}
-          NAME=${REGISTRY_AND_IMAGE##*/}
-          PURL="pkg:oci/$NAME?repository_url=$REGISTRY_AND_IMAGE"
-          echo "$PURL" > artifact-purl.txt
-          SAFE_PURL=$(echo -n "$PURL" | jq -s -R -r @uri)
-          echo "$SAFE_PURL" > artifact-purl-safe.txt
-          echo "purl=$PURL" >> $GITHUB_OUTPUT
+          echo "purl=$ARTIFACT_NAME" >> $GITHUB_OUTPUT
+          echo "$ARTIFACT_NAME" > artifact-purl.txt
+          echo "$ARTIFACT_URL_ENCODED" > artifact-purl-safe.txt
+        env:
+          ARTIFACT_NAME: ${{ env.ARTIFACT_NAME }}
+          ARTIFACT_URL_ENCODED: ${{ env.ARTIFACT_URL_ENCODED }}
 
       - name: Upload artifact-purl artifact
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 - https://github.com/actions/upload-artifact/releases/tag/v4.6.2