nais/GAR build/push/sign
Build, push, and sign (to Google Artifact Registry and optionally to GHCR)
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 3, 2026
- License
- MIT
Pinned Snippet
uses: nais/platform-build-push-sign@07a21e2293624a78499c79eeea3ce6d314f8a8d9 # no releases — HEAD as of 2026-07-11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| dockerfile | Dockerfile path | — | Dockerfile |
| name | Name of image | yes | — |
| google_service_account | Name of google service account to impersonate | no | — |
| push | Whether or not to push image | — | true |
| push_ghcr | Whether or not to push image to GHCR | — | false |
| workload_identity_provider | The workload identity provider for google service account impersonation | no | — |
| registry | The Google Artifact Registry path to push image to | — | europe-north1-docker.pkg.dev/nais-io/nais/images |
| build_args | List of build args | no | — |
| build_secrets | List of secrets | no | — |
| sbom | existing SBOM in cyclonedx format | — | auto-generate-for-me-please.json |
| additional_sboms | Newline-separated list of extra CycloneDX SBOM files to merge with the primary SBOM | no | "" |
| extra_tags | A list of tags to be applied in addition to the detailed time+sha-tag and latest-tag | — | "" |
| multi-platform | Build multi-platform images, supporting amd64 and arm64 | — | false |
| context | Docker build context | — | . |
| cache_from | cache-from sent to docker/build-push-action | — | type=gha |
| cache_to | cache-to sent to docker/build-push-action | — | type=gha,mode=max |
| target | docker target | no | — |
Outputs
| name | description |
|---|---|
| tag | full image tag |
| version | version |
| image | Canonical image reference |
| digest | Image digest |