docker: use Github registry

Author: erdnaxe

.github/workflows/docker.yml

@@ -1,6 +1,6 @@
-# Copyright (C) 2024  ANSSI
+# Copyright (C) 2026  A. Iooss
 # SPDX-License-Identifier: CC0-1.0
-name: Publish Docker image
+name: Create and publish a Docker image
 
 on:
   push:
@@ -10,42 +10,54 @@ on:
     tags:
       - '*'
 
+env:
+  REGISTRY: ghcr.io
+
 jobs:
-  push_to_registry:
+  build-and-push-image:
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+
     strategy:
       matrix:
         include:
           - context: ./webapp
-            image: anssi/shovel-webapp
+            image: ${{ github.repository }}/webapp
             platforms: linux/amd64,linux/arm64
           - context: ./suricata
-            image: anssi/shovel-suricata
+            image: ${{ github.repository }}/suricata
             platforms: linux/amd64,linux/arm64
           - context: ./grafana
-            image: anssi/shovel-grafana
+            image: ${{ github.repository }}/grafana
             platforms: linux/amd64,linux/arm64
     steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3
+      - uses: actions/checkout@v6
+      - uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130
         with:
-          platforms: "arm,arm64,s390x,ppc64le"
-      - uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb
-      - uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20
+          platforms: "arm,arm64"
+      - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
         with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051
         with:
-          images: ${{ matrix.image }}
+          images: ${{ env.REGISTRY }}/${{ matrix.image }}
           tags: |
             type=ref,event=branch
             type=ref,event=tag
-            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=latest,enable={{ is_default_branch }}
       - name: Build and push Docker image
-        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0
+        id: push
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
         with:
           context: ${{ matrix.context }}
           platforms: ${{ matrix.platforms }}
@@ -54,3 +66,9 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ matrix.image }}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true

docker-compose.yml

@@ -3,7 +3,7 @@
 services:
   suricata:
     build: ./suricata
-    image: anssi/shovel-suricata:dev
+    image: ghcr.io/FCSC-FR/shovel/suricata:dev
     volumes:
       - "./input_pcaps:/input_pcaps:ro"
       - "./suricata/rules:/suricata/rules:ro"
@@ -34,7 +34,7 @@ services:
 
   webapp:
     build: ./webapp
-    image: anssi/shovel-webapp:dev
+    image: ghcr.io/FCSC-FR/shovel/webapp:dev
     restart: always
     volumes:
       # Write access is required in SQLite `mode=ro` as readers need to record
@@ -50,7 +50,7 @@ services:
   # Grafana default credentials are admin:admin
   grafana:
     build: ./grafana
-    image: anssi/shovel-grafana:dev
+    image: ghcr.io/FCSC-FR/shovel/grafana:dev
     restart: always
     volumes:
       - "./suricata/output:/suricata/output:rw"