From 65ba54429d776f2b7f7f55e58b519cffb9a0c55f Mon Sep 17 00:00:00 2001
From: Alexey Pustovalov <alexey.pustovalov@zabbix.com>
Date: Thu, 30 May 2024 14:40:52 +0900
Subject: [PATCH] Test attestation

---
 .github/workflows/images_build.yml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/.github/workflows/images_build.yml b/.github/workflows/images_build.yml
index c7c9099cd..000201b70 100644
--- a/.github/workflows/images_build.yml
+++ b/.github/workflows/images_build.yml
@@ -525,6 +525,22 @@ jobs:
 
             echo "base_build_image=${IMAGE_NAME}@${IMAGE_DIGEST}" >> $GITHUB_OUTPUT
 
+      - name: Verify ${{ env.BASE_BUILD_NAME }}:${{ matrix.os }} attestation
+        if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
+        env:
+         BASE_IMAGE: ${{ steps.base_build.outputs.base_build_image }}
+         REPOSITORY: ${{ github.repository }}
+         DOCKER_REGISTRY: ${{ env.DOCKER_REGISTRY }}
+         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+            echo "::group::Image sign data"
+            echo "Image to verify=$BASE_IMAGE"
+            echo "::endgroup::"
+
+            echo "::group::Verify signature"
+            gh attestation verify oci://$DOCKER_REGISTRY/$BASE_IMAGE -R $REPOSITORY
+            echo "::endgroup::"
+
       - name: Prepare cache data
         id: cache_data
         env: