Merge pull request #823 from crazy-max/buildx-attestations-digest

buildx(imagetools): return attestations digests

src/buildx/imagetools.ts

@@ -17,7 +17,10 @@
 import {Buildx} from './buildx';
 import {Exec} from '../exec';
 
+import {Manifest as ImageToolsManifest} from '../types/buildx/imagetools';
 import {Image} from '../types/oci/config';
+import {Descriptor} from '../types/oci/descriptor';
+import {Digest} from '../types/oci/digest';
 
 export interface ImageToolsOpts {
   buildx?: Buildx;
@@ -58,4 +61,37 @@ export class ImageTools {
       throw new Error('Unexpected output format');
     });
   }
+
+  public async inspectManifest(name: string): Promise<ImageToolsManifest | Descriptor> {
+    const cmd = await this.getInspectCommand([name, '--format', '{{json .Manifest}}']);
+    return await Exec.getExecOutput(cmd.command, cmd.args, {
+      ignoreReturnCode: true,
+      silent: true
+    }).then(res => {
+      if (res.stderr.length > 0 && res.exitCode != 0) {
+        throw new Error(res.stderr.trim());
+      }
+      const parsedOutput = JSON.parse(res.stdout);
+      if (typeof parsedOutput === 'object' && !Array.isArray(parsedOutput) && parsedOutput !== null) {
+        if (Object.prototype.hasOwnProperty.call(parsedOutput, 'manifests')) {
+          return <ImageToolsManifest>parsedOutput;
+        } else {
+          return <Descriptor>parsedOutput;
+        }
+      }
+      throw new Error('Unexpected output format');
+    });
+  }
+
+  public async attestationDescriptors(name: string): Promise<Array<Descriptor>> {
+    const manifest = await this.inspectManifest(name);
+    if (typeof manifest === 'object' && manifest !== null && 'manifests' in manifest && Array.isArray(manifest.manifests)) {
+      return manifest.manifests.filter(m => m.annotations && m.annotations['vnd.docker.reference.type'] === 'attestation-manifest');
+    }
+    throw new Error(`No attestation descriptors found for ${name}`);
+  }
+
+  public async attestationDigests(name: string): Promise<Array<Digest>> {
+    return (await this.attestationDescriptors(name)).map(attestation => attestation.digest);
+  }
 }

src/types/buildx/imagetools.ts

@@ -0,0 +1,28 @@
+/**
+ * Copyright 2025 actions-toolkit authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {Versioned} from '../oci/versioned';
+import {Descriptor} from '../oci/descriptor';
+import {Digest} from '../oci/digest';
+
+// https://github.com/docker/buildx/blob/62857022a08552bee5cad0c3044a9a3b185f0b32/util/imagetools/printers.go#L109-L123
+export interface Manifest extends Versioned {
+  mediaType?: string;
+  digest: Digest;
+  size: number;
+  manifests?: Descriptor[];
+  annotations?: Record<string, string>;
+}