build_multi_arch_image.yml

name: Build and push docker image
'on':
  workflow_call:
    inputs:
      tag_latest:
        required: true
        type: boolean
      docker_tag:
        required: true
        type: string
      container_name:
        required: true
        type: string
      base_folder:
        required: true
        type: string
      NO_CACHE:
        required: true
        type: boolean
      EXTRA_COMMON:
        required: false
        type: string

jobs:
  build_and_push_image:
    name: Build image for ${{ inputs.container_name }} on ${{ matrix.arch }}
    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write
    runs-on: '${{ matrix.runner }}'

    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            runner: ubuntu-22.04
          - arch: arm64
            runner: ubuntu-22.04-arm
    steps:
      - name: Free Disk Space for Docker
        uses: endersonmenezes/free-disk-space@7901478139cff6e9d44df5972fd8ab8fcade4db1
        with:
          remove_android: true
          remove_dotnet: true
          remove_haskell: true
          remove_tool_cache: true
          rm_cmd: rm
          remove_packages: >-
            azure-cli google-cloud-cli microsoft-edge-stable
            google-chrome-stable firefox postgresql* temurin-* *llvm* mysql*
            dotnet-sdk-*
          remove_packages_one_command: true
      - name: Login to github container registry
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2
        with:
              registry: ghcr.io
              username: ${{github.actor}}
              password: ${{secrets.GITHUB_TOKEN}}
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          fetch-depth: 0
      - name: setup trivy
        uses: aquasecurity/setup-trivy@3fb12ec12f41e471780db15c232d5dd185dcb514
        with:
          version: v0.69.3
      - name: setup node
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
        with:
          node-version-file: .tool-versions
  
      - name: make install
        run: |
          make install-node

      - name: Build container
        run: |
          echo "Building image..."
          make build-image
        env:
          ARCHITECTURE: '${{ matrix.arch }}'
          CONTAINER_NAME: '${{ inputs.container_name }}'
          MULTI_ARCH_TAG: '${{ inputs.docker_tag }}'
          BASE_VERSION_TAG: ${{ inputs.docker_tag}}
          IMAGE_TAG: "${{ inputs.docker_tag }}-${{ matrix.arch }}"
          BASE_FOLDER: "${{ inputs.base_folder }}"
          NO_CACHE: '${{ inputs.NO_CACHE }}'
          BUILDX_NO_DEFAULT_ATTESTATIONS: "1"
      - name: Check docker vulnerabilities - json output
        run: |
          make scan-image-json
        env:
          CONTAINER_NAME: '${{ inputs.container_name }}'
          BASE_FOLDER: "${{ inputs.base_folder }}"
          IMAGE_TAG: "${{ inputs.docker_tag }}-${{ matrix.arch }}"
          EXIT_CODE: 0
          EXTRA_COMMON: "${{ inputs.extra_common }}"
      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
        name: Upload scan results
        with:
          name: "scan_results_docker_${{ inputs.container_name }}_${{ matrix.arch }}.json"
          path: .out/scan_results_docker.json
      - name: Check docker vulnerabilities - table output
        run: |
          make scan-image
        env:
          CONTAINER_NAME: '${{ inputs.container_name }}'
          BASE_FOLDER: "${{ inputs.base_folder }}"
          IMAGE_TAG: "${{ inputs.docker_tag }}-${{ matrix.arch }}"
          EXIT_CODE: "1"
          EXTRA_COMMON: "${{ inputs.extra_common }}"
      - name: Show docker vulnerability output
        if: always()
        run: |
          echo "Scan output for ghcr.io/nhsdigital/eps-devcontainers/base:${DOCKER_TAG}-${ARCHITECTURE}"
          if [ -f .out/scan_results_docker.txt ]; then
            cat .out/scan_results_docker.txt
          fi
        env:
          ARCHITECTURE: '${{ matrix.arch }}'
          DOCKER_TAG: '${{ inputs.docker_tag }}'
      - name: Push tagged image and rebuild for github actions
        run: |
          echo "Pushing image..."
          docker push "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}-${ARCHITECTURE}"
          echo "## PUSHED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}-${ARCHITECTURE}" >> "$GITHUB_STEP_SUMMARY"

          echo "Rebuilding image for github actions with tag githubactions-${DOCKER_TAG}-${ARCHITECTURE}"
          make build-githubactions-image BASE_IMAGE_NAME="${CONTAINER_NAME}" BASE_IMAGE_TAG="${DOCKER_TAG}-${ARCHITECTURE}" IMAGE_TAG="${DOCKER_TAG}-${ARCHITECTURE}" NO_CACHE="${{ inputs.NO_CACHE }}"
          echo "Pushing github actions image..."
          docker push "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}-${ARCHITECTURE}"
          echo "## PUSHED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}-${ARCHITECTURE}" >> "$GITHUB_STEP_SUMMARY"
        env:
          DOCKER_TAG: ${{ inputs.docker_tag }}
          CONTAINER_NAME: '${{ inputs.container_name }}'
          ARCHITECTURE: '${{ matrix.arch }}'
          BUILDX_NO_DEFAULT_ATTESTATIONS: "1"
      - name: Resolve image digest
        id: resolve_arch_digest
        run: |
          DIGEST=$(docker buildx imagetools inspect "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}-${ARCHITECTURE}" | awk '/^Digest:/ {print $2; exit}')
          echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
          echo "Resolved digest ${DIGEST} for ${DOCKER_TAG}-${ARCHITECTURE}"
        env:
          DOCKER_TAG: ${{ inputs.docker_tag }}
          CONTAINER_NAME: '${{ inputs.container_name }}'
          ARCHITECTURE: '${{ matrix.arch }}'
      - name: Attest image
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32
        with:
          subject-name: ghcr.io/nhsdigital/eps-devcontainers/${{ inputs.container_name }}
          subject-digest: ${{ steps.resolve_arch_digest.outputs.digest }}
          push-to-registry: false
      - name: Summarise attested image
        run: |
          echo "## ATTESTED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}-${ARCHITECTURE}@${DIGEST}" >> "$GITHUB_STEP_SUMMARY"
        env:
          DOCKER_TAG: ${{ inputs.docker_tag }}
          CONTAINER_NAME: '${{ inputs.container_name }}'
          ARCHITECTURE: '${{ matrix.arch }}'
          DIGEST: ${{ steps.resolve_arch_digest.outputs.digest }}
      - name: Resolve github actions image digest
        id: resolve_githubactions_arch_digest
        run: |
          DIGEST=$(docker buildx imagetools inspect "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}-${ARCHITECTURE}" | awk '/^Digest:/ {print $2; exit}')
          echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
          echo "Resolved digest ${DIGEST} for githubactions-${DOCKER_TAG}-${ARCHITECTURE}"
        env:
          DOCKER_TAG: ${{ inputs.docker_tag }}
          CONTAINER_NAME: '${{ inputs.container_name }}'
          ARCHITECTURE: '${{ matrix.arch }}'
      - name: Attest github actions image
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32
        with:
          subject-name: ghcr.io/nhsdigital/eps-devcontainers/${{ inputs.container_name }}
          subject-digest: ${{ steps.resolve_githubactions_arch_digest.outputs.digest }}
          push-to-registry: false
      - name: Summarise attested github actions image
        run: |
          echo "## ATTESTED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}-${ARCHITECTURE}@${DIGEST}" >> "$GITHUB_STEP_SUMMARY"
        env:
          DOCKER_TAG: ${{ inputs.docker_tag }}
          CONTAINER_NAME: '${{ inputs.container_name }}'
          ARCHITECTURE: '${{ matrix.arch }}'
          DIGEST: ${{ steps.resolve_githubactions_arch_digest.outputs.digest }}
      - name: Push latest image
        if: ${{ inputs.tag_latest }}
        run: |
          docker tag "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}-${ARCHITECTURE}" "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest-${ARCHITECTURE}"
          echo "Pushing latest image..."
          docker push "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest-${ARCHITECTURE}"
          echo "## PUSHED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest-${ARCHITECTURE}" >> "$GITHUB_STEP_SUMMARY"

          docker tag "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}-${ARCHITECTURE}" "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest-${ARCHITECTURE}"
          echo "Pushing github actions latest image..."
          docker push "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest-${ARCHITECTURE}"
          echo "## PUSHED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest-${ARCHITECTURE}" >> "$GITHUB_STEP_SUMMARY"
        env:
          DOCKER_TAG: ${{ inputs.docker_tag }}
          CONTAINER_NAME: '${{ inputs.container_name }}'
          ARCHITECTURE: '${{ matrix.arch }}'
      - name: Resolve github actions latest image digest
        if: ${{ inputs.tag_latest }}
        id: resolve_githubactions_latest_arch_digest
        run: |
          DIGEST=$(docker buildx imagetools inspect "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest-${ARCHITECTURE}" | awk '/^Digest:/ {print $2; exit}')
          echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
          echo "Resolved digest ${DIGEST} for githubactions-latest-${ARCHITECTURE}"
        env:
          CONTAINER_NAME: '${{ inputs.container_name }}'
          ARCHITECTURE: '${{ matrix.arch }}'
      - name: Attest github actions latest image
        if: ${{ inputs.tag_latest }}
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32
        with:
          subject-name: ghcr.io/nhsdigital/eps-devcontainers/${{ inputs.container_name }}
          subject-digest: ${{ steps.resolve_githubactions_latest_arch_digest.outputs.digest }}
          push-to-registry: false
      - name: Summarise attested github actions latest image
        if: ${{ inputs.tag_latest }}
        run: |
          echo "## ATTESTED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest-${ARCHITECTURE}@${DIGEST}" >> "$GITHUB_STEP_SUMMARY"
        env:
          CONTAINER_NAME: '${{ inputs.container_name }}'
          ARCHITECTURE: '${{ matrix.arch }}'
          DIGEST: ${{ steps.resolve_githubactions_latest_arch_digest.outputs.digest }}
      - name: Resolve latest image digest
        if: ${{ inputs.tag_latest }}
        id: resolve_latest_arch_digest
        run: |
          DIGEST=$(docker buildx imagetools inspect "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest-${ARCHITECTURE}" | awk '/^Digest:/ {print $2; exit}')
          echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
          echo "Resolved digest ${DIGEST} for latest-${ARCHITECTURE}"
        env:
          CONTAINER_NAME: '${{ inputs.container_name }}'
          ARCHITECTURE: '${{ matrix.arch }}'
      - name: Attest latest image
        if: ${{ inputs.tag_latest }}
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32
        with:
          subject-name: ghcr.io/nhsdigital/eps-devcontainers/${{ inputs.container_name }}
          subject-digest: ${{ steps.resolve_latest_arch_digest.outputs.digest }}
          push-to-registry: false
      - name: Summarise attested latest image
        if: ${{ inputs.tag_latest }}
        run: |
          echo "## ATTESTED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest-${ARCHITECTURE}@${DIGEST}" >> "$GITHUB_STEP_SUMMARY"
        env:
          CONTAINER_NAME: '${{ inputs.container_name }}'
          ARCHITECTURE: '${{ matrix.arch }}'
          DIGEST: ${{ steps.resolve_latest_arch_digest.outputs.digest }}
  publish_combined_image:
    name: Publish combined image for ${{ inputs.container_name }}
    runs-on: ubuntu-22.04
    needs: build_and_push_image
    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write
    steps:
      - name: Login to github container registry
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2
        with:
              registry: ghcr.io
              username: ${{github.actor}}
              password: ${{secrets.GITHUB_TOKEN}}

      - name: Push multi-arch tagged image
        run: |
          BUILD_TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
          export BUILD_TIMESTAMP
          echo "Creating combined image for tag ${DOCKER_TAG}"
          docker buildx imagetools create \
            --annotation "index:org.opencontainers.image.source=https://github.com/NHSDigital/eps-devcontainers" \
            --annotation "index:org.opencontainers.image.description=EPS devcontainer ${CONTAINER_NAME}:${DOCKER_TAG}" \
            --annotation "index:org.opencontainers.image.licenses=MIT" \
            --annotation "index:org.opencontainers.image.version=${DOCKER_TAG}" \
            --annotation "index:org.opencontainers.image.containerName=${CONTAINER_NAME}" \
            --annotation "index:org.opencontainers.image.created=${BUILD_TIMESTAMP}" \
            --annotation "index:org.opencontainers.image.authors=NHS England EPS Team" \
            --tag "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}" \
            "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}-amd64" \
            "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}-arm64"
          echo "## PUSHED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}" >> "$GITHUB_STEP_SUMMARY"

          echo "Creating combined image for tag githubactions-${DOCKER_TAG}"
          docker buildx imagetools create \
            --annotation "index:org.opencontainers.image.source=https://github.com/NHSDigital/eps-devcontainers" \
            --annotation "index:org.opencontainers.image.description=EPS devcontainer ${CONTAINER_NAME}:${DOCKER_TAG}" \
            --annotation "index:org.opencontainers.image.licenses=MIT" \
            --annotation "index:org.opencontainers.image.version=${DOCKER_TAG}" \
            --annotation "index:org.opencontainers.image.containerName=${CONTAINER_NAME}" \
            --annotation "index:org.opencontainers.image.created=${BUILD_TIMESTAMP}" \
            --annotation "index:org.opencontainers.image.authors=NHS England EPS Team" \
            --tag "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}" \
            "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}-amd64" \
            "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}-arm64"
          echo "## PUSHED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}" >> "$GITHUB_STEP_SUMMARY"
        env:
          DOCKER_TAG: ${{ inputs.docker_tag }}
          CONTAINER_NAME: '${{ inputs.container_name }}'

      - name: Push multi-arch latest image
        if: ${{ inputs.tag_latest }}
        run: |
          echo "Creating combined image for tag latest"
          docker buildx imagetools create -t "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest" \
            "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest-amd64" \
            "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest-arm64"
          echo "## PUSHED COMBINED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest" >> "$GITHUB_STEP_SUMMARY"

          echo "Creating combined image for tag githubactions-latest"
          docker buildx imagetools create -t "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest" \
            "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest-amd64" \
            "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest-arm64"
          echo "## PUSHED COMBINED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest" >> "$GITHUB_STEP_SUMMARY"

        env:
          DOCKER_TAG: ${{ inputs.docker_tag }}
          CONTAINER_NAME: '${{ inputs.container_name }}'

      - name: Resolve combined image digest
        id: resolve_combined_digest
        run: |
          DIGEST=$(docker buildx imagetools inspect "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}" | awk '/^Digest:/ {print $2; exit}')
          echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
          echo "Resolved digest ${DIGEST} for ${DOCKER_TAG}"
        env:
          DOCKER_TAG: ${{ inputs.docker_tag }}
          CONTAINER_NAME: '${{ inputs.container_name }}'

      - name: Attest combined image
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32
        with:
          subject-name: ghcr.io/nhsdigital/eps-devcontainers/${{ inputs.container_name }}
          subject-digest: ${{ steps.resolve_combined_digest.outputs.digest }}
          push-to-registry: false
      - name: Summarise attested combined image
        run: |
          echo "## ATTESTED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:${DOCKER_TAG}@${DIGEST}" >> "$GITHUB_STEP_SUMMARY"
        env:
          DOCKER_TAG: ${{ inputs.docker_tag }}
          CONTAINER_NAME: '${{ inputs.container_name }}'
          DIGEST: ${{ steps.resolve_combined_digest.outputs.digest }}

      - name: Resolve combined github actions image digest
        id: resolve_githubactions_combined_digest
        run: |
          DIGEST=$(docker buildx imagetools inspect "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}" | awk '/^Digest:/ {print $2; exit}')
          echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
          echo "Resolved digest ${DIGEST} for githubactions-${DOCKER_TAG}"
        env:
          DOCKER_TAG: ${{ inputs.docker_tag }}
          CONTAINER_NAME: '${{ inputs.container_name }}'

      - name: Attest combined github actions image
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32
        with:
          subject-name: ghcr.io/nhsdigital/eps-devcontainers/${{ inputs.container_name }}
          subject-digest: ${{ steps.resolve_githubactions_combined_digest.outputs.digest }}
          push-to-registry: false
      - name: Summarise attested combined github actions image
        run: |
          echo "## ATTESTED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-${DOCKER_TAG}@${DIGEST}" >> "$GITHUB_STEP_SUMMARY"
        env:
          DOCKER_TAG: ${{ inputs.docker_tag }}
          CONTAINER_NAME: '${{ inputs.container_name }}'
          DIGEST: ${{ steps.resolve_githubactions_combined_digest.outputs.digest }}

      - name: Resolve latest github actions image digest
        if: ${{ inputs.tag_latest }}
        id: resolve_githubactions_latest_digest
        run: |
          DIGEST=$(docker buildx imagetools inspect "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest" | awk '/^Digest:/ {print $2; exit}')
          echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
          echo "Resolved digest ${DIGEST} for githubactions-latest"
        env:
          CONTAINER_NAME: '${{ inputs.container_name }}'

      - name: Attest latest github actions image
        if: ${{ inputs.tag_latest }}
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32
        with:
          subject-name: ghcr.io/nhsdigital/eps-devcontainers/${{ inputs.container_name }}
          subject-digest: ${{ steps.resolve_githubactions_latest_digest.outputs.digest }}
          push-to-registry: false
      - name: Summarise attested latest github actions image
        if: ${{ inputs.tag_latest }}
        run: |
          echo "## ATTESTED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:githubactions-latest@${DIGEST}" >> "$GITHUB_STEP_SUMMARY"
        env:
          CONTAINER_NAME: '${{ inputs.container_name }}'
          DIGEST: ${{ steps.resolve_githubactions_latest_digest.outputs.digest }}

      - name: Resolve latest image digest
        if: ${{ inputs.tag_latest }}
        id: resolve_latest_digest
        run: |
          DIGEST=$(docker buildx imagetools inspect "ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest" | awk '/^Digest:/ {print $2; exit}')
          echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
          echo "Resolved digest ${DIGEST} for latest"
        env:
          CONTAINER_NAME: '${{ inputs.container_name }}'

      - name: Attest latest image
        if: ${{ inputs.tag_latest }}
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32
        with:
          subject-name: ghcr.io/nhsdigital/eps-devcontainers/${{ inputs.container_name }}
          subject-digest: ${{ steps.resolve_latest_digest.outputs.digest }}
          push-to-registry: false
      - name: Summarise attested latest image
        if: ${{ inputs.tag_latest }}
        run: |
          echo "## ATTESTED IMAGE : ghcr.io/nhsdigital/eps-devcontainers/${CONTAINER_NAME}:latest@${DIGEST}" >> "$GITHUB_STEP_SUMMARY"
        env:
          CONTAINER_NAME: '${{ inputs.container_name }}'
          DIGEST: ${{ steps.resolve_latest_digest.outputs.digest }}