use published from main

Author: anthony-nhs

.github/workflows/quality-checks-devcontainer.yml

@@ -30,7 +30,6 @@ jobs:
     uses: ./.github/workflows/verify_attestation.yml
     with:
       runtime_docker_image: "${{ inputs.runtime_docker_image }}"
-      source_ref: "refs/heads/main"
   quality_checks:
     runs-on: ubuntu-22.04
     needs: verify_attestation

.github/workflows/verify_attestation.yml

@@ -18,10 +18,10 @@ name: Verify image digest and attestation
                 required: false
                 type: string
                 default: NHSDigital
-            source_ref:
+            use_published_from_main_image:
                 required: false
-                type: string
-                default: ""
+                type: boolean
+                default: true
             predicate_type:
                 required: false
                 type: string
@@ -94,16 +94,16 @@ jobs:
               env:
                   GH_TOKEN: ${{ github.token }}
                   OWNER: ${{ inputs.owner }}
-                  SOURCE_REF: ${{ inputs.source_ref }}
+                  USE_PUBLISHED_FROM_MAIN_IMAGE: ${{ inputs.use_published_from_main_image }}
                   PREDICATE_TYPE: ${{ inputs.predicate_type }}
                   PINNED_IMAGE: ${{ steps.resolve.outputs.pinned_image }}
               run: |
                   set -euo pipefail
 
                   args=("oci://${PINNED_IMAGE}" "--owner" "$OWNER" "--predicate-type" "$PREDICATE_TYPE")
 
-                  if [[ -n "$SOURCE_REF" ]]; then
-                    args+=("--source-ref" "$SOURCE_REF")
+                  if [[ "$USE_PUBLISHED_FROM_MAIN_IMAGE" == "true" ]]; then
+                    args+=("--source-ref" "refs/heads/main")
                   fi