From df3ca02e8b0d8e9f4ba7027e43eb1d35e6f93b80 Mon Sep 17 00:00:00 2001
From: Mike Cao <moocao@gmail.com>
Date: Fri, 7 Nov 2025 08:52:16 -0800
Subject: [PATCH 1/3] Always push latest for Docker.

---
 .github/workflows/cd.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 3098d314b..515aa2aad 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -54,7 +54,8 @@ jobs:
             VERSION="${INPUT#v}"
             MAJOR=$(echo "$VERSION" | cut -d. -f1)
             MINOR=$(echo "$VERSION" | cut -d. -f2)
-            echo "version_tags=${VERSION},${MAJOR}.${MINOR},${MAJOR}" >> $GITHUB_ENV
+            # Include latest explicitly
+            echo "version_tags=${VERSION},${MAJOR}.${MINOR},${MAJOR},latest" >> $GITHUB_ENV
           else
             echo "version_tags=" >> $GITHUB_ENV
           fi
@@ -69,17 +70,16 @@ jobs:
           flavor: |
             latest=auto
           tags: |
-            # Semver tags from real Git tags
+            # From real Git tags (v1.2.3)
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
 
-            # Manual input derived tags
+            # Manual input tags
             type=raw,value=${{ env.version_tags }},enable=${{ env.version_tags != '' }}
 
-            # Fallbacks for branches/PRs
+            # Fallbacks
             type=ref,event=branch
-            type=ref,event=pr
             type=sha
 
       - name: Build and push Docker image

From d2f512cae7af0538fc67231404d9ed31ff2c3adb Mon Sep 17 00:00:00 2001
From: Mike Cao <moocao@gmail.com>
Date: Fri, 7 Nov 2025 09:14:19 -0800
Subject: [PATCH 2/3] Don't publish .sig files.

---
 .github/workflows/cd-manual.yml | 58 ---------------------------------
 .github/workflows/cd.yml        | 21 +++++-------
 2 files changed, 9 insertions(+), 70 deletions(-)
 delete mode 100644 .github/workflows/cd-manual.yml

diff --git a/.github/workflows/cd-manual.yml b/.github/workflows/cd-manual.yml
deleted file mode 100644
index df6aa6289..000000000
--- a/.github/workflows/cd-manual.yml
+++ /dev/null
@@ -1,58 +0,0 @@
-name: Create docker images (manual)
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        type: string
-        description: Version
-        required: true
-
-jobs:
-  build:
-    name: Build, push, and deploy
-    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        db-type: [postgresql]
-
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Extract version parts from input
-        id: extract_version
-        run: |
-          echo "version=$(echo ${{ github.event.inputs.version }})" >> $GITHUB_ENV
-          echo "major=$(echo ${{ github.event.inputs.version }} | cut -d. -f1)" >> $GITHUB_ENV
-          echo "minor=$(echo ${{ github.event.inputs.version }} | cut -d. -f2)" >> $GITHUB_ENV
-
-      - name: Generate tags
-        id: generate_tags
-        run: |
-          echo "tag_major=$(echo ${{ matrix.db-type }}-${{ env.major }})" >> $GITHUB_ENV
-          echo "tag_minor=$(echo ${{ matrix.db-type }}-${{ env.major }}.${{ env.minor }})" >> $GITHUB_ENV
-          echo "tag_patch=$(echo ${{ matrix.db-type }}-${{ env.version }})" >> $GITHUB_ENV
-          echo "tag_latest=$(echo ${{ matrix.db-type }}-latest)" >> $GITHUB_ENV
-
-      - uses: mr-smithers-excellent/docker-build-push@v6
-        name: Build & push Docker image to ghcr.io for ${{ matrix.db-type }}
-        with:
-          image: umami
-          tags: ${{ env.tag_major }}, ${{ env.tag_minor }}, ${{ env.tag_patch }}, ${{ env.tag_latest }}
-          buildArgs: DATABASE_TYPE=${{ matrix.db-type }}
-          registry: ghcr.io
-          multiPlatform: true
-          platform: linux/amd64,linux/arm64
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - uses: mr-smithers-excellent/docker-build-push@v6
-        name: Build & push Docker image to docker.io for ${{ matrix.db-type }}
-        with:
-          image: umamisoftware/umami
-          tags: ${{ env.tag_major }}, ${{ env.tag_minor }}, ${{ env.tag_patch }}, ${{ env.tag_latest }}
-          buildArgs: DATABASE_TYPE=${{ matrix.db-type }}
-          registry: docker.io
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 515aa2aad..a4934e797 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -50,11 +50,9 @@ jobs:
         run: |
           INPUT="${{ github.event.inputs.version }}"
           if [[ -n "$INPUT" ]]; then
-            # Strip leading v if present
             VERSION="${INPUT#v}"
             MAJOR=$(echo "$VERSION" | cut -d. -f1)
             MINOR=$(echo "$VERSION" | cut -d. -f2)
-            # Include latest explicitly
             echo "version_tags=${VERSION},${MAJOR}.${MINOR},${MAJOR},latest" >> $GITHUB_ENV
           else
             echo "version_tags=" >> $GITHUB_ENV
@@ -70,15 +68,10 @@ jobs:
           flavor: |
             latest=auto
           tags: |
-            # From real Git tags (v1.2.3)
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
-
-            # Manual input tags
             type=raw,value=${{ env.version_tags }},enable=${{ env.version_tags != '' }}
-
-            # Fallbacks
             type=ref,event=branch
             type=sha
 
@@ -93,9 +86,13 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+          provenance: false # disable automatic attestations
+
+      # Generate a local provenance attestation instead of uploading signatures
+      - name: Generate provenance attestation
+        run: |
+          cosign attest --yes \
+            --predicate <(echo '{"build":"github-actions","repo":"${{ github.repository }}","run_id":"${{ github.run_id }}"}') \
+            --type slsaprovenance \
+            ${{ steps.meta.outputs.tags }}
 
-      - name: Sign the published Docker image
-        env:
-          TAGS: ${{ steps.meta.outputs.tags }}
-          DIGEST: ${{ steps.build-and-push.outputs.digest }}
-        run: echo "${TAGS}" | xargs -I {} cosign sign --yes "{}@${DIGEST}"

From 3e9ca8761ee4ae3dab686fd4fceea0f9aec29e20 Mon Sep 17 00:00:00 2001
From: Mike Cao <moocao@gmail.com>
Date: Fri, 7 Nov 2025 09:15:01 -0800
Subject: [PATCH 3/3] Removed workflow script.

---
 .github/workflows/delete-untagged-images.yml | 22 --------------------
 1 file changed, 22 deletions(-)
 delete mode 100644 .github/workflows/delete-untagged-images.yml

diff --git a/.github/workflows/delete-untagged-images.yml b/.github/workflows/delete-untagged-images.yml
deleted file mode 100644
index a23a1bd27..000000000
--- a/.github/workflows/delete-untagged-images.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-name: Delete untagged GHCR images
-
-on:
-  workflow_dispatch: # Run manually from the Actions tab
-
-jobs:
-  cleanup:
-    name: Delete all untagged images
-    runs-on: ubuntu-latest
-
-    permissions:
-      packages: write
-      contents: read
-
-    steps:
-      - name: Delete untagged GHCR images
-        uses: actions/delete-package-versions@v5
-        with:
-          package-name: "umami" # 👈 change if your GHCR package name differs
-          package-type: "container"
-          delete-only-untagged-versions: true
-          min-versions-to-keep: 0