try again

Author: anthony-nhs

.github/workflows/pull_request.yml

@@ -51,6 +51,10 @@ jobs:
   tag_release:
     needs: [quality_checks, get_config_values]
     uses: ./.github/workflows/tag-release-devcontainer.yml
+    permissions:
+      contents: read
+      packages: read
+      attestations: read
     with:
       dry_run: true
       runtime_docker_image: "${{ needs.get_config_values.outputs.devcontainer_image }}:githubactions-${{ needs.get_config_values.outputs.devcontainer_version }}"

.github/workflows/verify-runtime-image.yml

@@ -55,19 +55,23 @@ jobs:
               run: |
                   set -euo pipefail
 
-                  if [[ "$RUNTIME_IMAGE_INPUT" == *"/"* ]]; then
+                  FIRST_PATH_SEGMENT="${RUNTIME_IMAGE_INPUT%%/*}"
+                  if [[ "$RUNTIME_IMAGE_INPUT" != *"/"* ]]; then
+                    IMAGE_REF="${REGISTRY}/${NAMESPACE}/${RUNTIME_IMAGE_INPUT}"
+                  elif [[ "$FIRST_PATH_SEGMENT" == *.* || "$FIRST_PATH_SEGMENT" == *:* || "$FIRST_PATH_SEGMENT" == "localhost" ]]; then
                     IMAGE_REF="$RUNTIME_IMAGE_INPUT"
                   else
-                    IMAGE_REF="${REGISTRY}/${NAMESPACE}/${RUNTIME_IMAGE_INPUT}"
+                    IMAGE_REF="${REGISTRY}/${RUNTIME_IMAGE_INPUT}"
                   fi
 
+                  echo "Resolved runtime image input '${RUNTIME_IMAGE_INPUT}' to '${IMAGE_REF}'"
+
                   if [[ "$IMAGE_REF" == *@sha256:* ]]; then
                     DIGEST="${IMAGE_REF#*@}"
                     IMAGE_BASE="${IMAGE_REF%@*}"
                   else
                     echo "Resolving digest for image: $IMAGE_REF"
                     DIGEST="$(docker buildx imagetools inspect "$IMAGE_REF" | awk '/^Digest:/ {print $2; exit}')"
-                    echo "Ran the command"
                     IMAGE_BASE="${IMAGE_REF%:*}"
                   fi