Artifact attestation

.github/workflows/deploy.yaml

@@ -161,6 +161,8 @@ jobs:
     permissions:
       contents: read
       packages: write
+      id-token: write
+      attestations: write
 
     # Build steps
     steps:
@@ -232,31 +234,18 @@ jobs:
 
           # Set full image name
           full_names="${{ env.REGISTRY }}/${{ github.repository_owner }}/${image_name}:${tag}"
+          attestation_image_name="${{ env.REGISTRY }}/${{ github.repository_owner }}/${image_name}"
+          echo "ATTESTATION_IMAGE_NAME=${attestation_image_name}" >> $GITHUB_OUTPUT
           echo "OUTPUT_IMAGE_NAME=${full_names}" >> $GITHUB_OUTPUT
-          if [ "${tag_latest}" == "true" ]
-          then
-            full_names="$full_names,${{ env.REGISTRY }}/${{ github.repository_owner }}/${image_name}:latest"
-          fi
-          if [ "${image_name}" == "rstudio-local_${{ needs.normalize-inputs.outputs.latest_r_version }}_bioc_${{ needs.normalize-inputs.outputs.latest_bioc_version }}" ] \
-            || [ "${image_name}" == "rstudio_${{ needs.normalize-inputs.outputs.latest_r_version }}_bioc_${{ needs.normalize-inputs.outputs.latest_bioc_version }}" ]
-          then
-            full_names="$full_names,${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ needs.normalize-inputs.outputs.distribution }}:latest"
-            full_names="$full_names,${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ needs.normalize-inputs.outputs.distribution }}:${tag}"
-          fi
           echo "FULL_NAMES=${full_names}" >> $GITHUB_OUTPUT
 
           echo "github.ref = ${{ github.ref }}"
-          # Set push if branch is main
-          if [ "${{ github.ref }}" == 'refs/heads/main' ]; then
-            echo "DOCKER_PUSH=true" >> $GITHUB_OUTPUT
-            echo "DOCKER_PUSH = true"
-          else
-            echo "DOCKER_PUSH=false" >> $GITHUB_OUTPUT
-            echo "DOCKER_PUSH = false"
-          fi
+          echo "DOCKER_PUSH=true" >> $GITHUB_OUTPUT
           echo "SBOM_OUTPUT_FILENAME=$GITHUB_WORKSPACE/sbom.json" >> $GITHUB_OUTPUT
+          echo "SBOM_OUTPUT_FILENAME_CYCLONEDX=$GITHUB_WORKSPACE/sbom.cyclonedx.json" >> $GITHUB_OUTPUT
 
       - name: Build and push image 🏗
+        id: push-image
         uses: docker/build-push-action@v5
         with:
           context: ./
@@ -297,6 +286,31 @@ jobs:
           output-file: "${{ steps.build_vars.outputs.SBOM_OUTPUT_FILENAME }}"
           artifact-name: "sbom.spdx"
 
+      - name: Generate SBOM (CycloneDX) 📃
+        uses: anchore/sbom-action@v0
+        with:
+          image: "${{ steps.build_vars.outputs.OUTPUT_IMAGE_NAME }}"
+          output-file: "${{ steps.build_vars.outputs.SBOM_OUTPUT_FILENAME_CYCLONEDX }}"
+          artifact-name: "sbom.cyclonedx"
+          format: "cyclonedx-json"
+
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-name: ${{ steps.build_vars.outputs.ATTESTATION_IMAGE_NAME }}
+          subject-digest: ${{ steps.push-image.outputs.digest }}
+          push-to-registry: true
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Generate SBOM attestation
+        uses: actions/attest-sbom@v1
+        with:
+          subject-name: ${{ steps.build_vars.outputs.ATTESTATION_IMAGE_NAME }}
+          subject-digest: ${{ steps.push-image.outputs.digest }}
+          sbom-path: ${{ steps.build_vars.outputs.SBOM_OUTPUT_FILENAME_CYCLONEDX }}
+          push-to-registry: true
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Upload image manifest to release 🔼
         uses: svenstaro/upload-release-action@v2
         if: "${{ needs.normalize-inputs.outputs.release_tag }} != ''"

.github/workflows/scheduled.yaml

@@ -94,6 +94,6 @@ jobs:
               "latest_r_version": "4.4.1",
               "latest_bioc_version": "3.19",
               "tag": "",
-              "tag_latest": "true",
+              "tag_latest": "false",
               "release_tag": "${{ needs.create-release.outputs.release_tag }}"
             }

Dockerfile

@@ -42,22 +42,24 @@ ENV CTAN_REPO https://mirrors.mit.edu/CTAN/systems/texlive/tlnet
 # Install sysdeps
 RUN ./install_sysdeps.sh ${DISTRIBUTION}
 
+RUN ./install_cran_pkgs.R ${DISTRIBUTION}
+
 # Install R packages
-RUN ./install_cran_pkgs.R ${DISTRIBUTION} && \
-    ./install_bioc.R ${BIOC_VERSION} && \
-    ./install_bioc_pkgs.R ${DISTRIBUTION} && \
-    ./install_gh_pkgs.R ${DISTRIBUTION} && \
-    ./install_other_pkgs.R ${DISTRIBUTION} && \
-    ./install_pip_pkgs.py ${DISTRIBUTION} && \
-    ./test_installations.sh && \
-    rm -f install_sysdeps.sh \
-        install_cran_pkgs.R \
-        install_bioc.R \
-        install_bioc_pkgs.R \
-        install_gh_pkgs.R \
-        install_other_pkgs.R \
-        install_pip_pkgs.py \
-        test_installations.sh
+# RUN ./install_cran_pkgs.R ${DISTRIBUTION} && \
+#     ./install_bioc.R ${BIOC_VERSION} && \
+#     ./install_bioc_pkgs.R ${DISTRIBUTION} && \
+#     ./install_gh_pkgs.R ${DISTRIBUTION} && \
+#     ./install_other_pkgs.R ${DISTRIBUTION} && \
+#     ./install_pip_pkgs.py ${DISTRIBUTION} && \
+#     ./test_installations.sh && \
+#     rm -f install_sysdeps.sh \
+#         install_cran_pkgs.R \
+#         install_bioc.R \
+#         install_bioc_pkgs.R \
+#         install_gh_pkgs.R \
+#         install_other_pkgs.R \
+#         install_pip_pkgs.py \
+#         test_installations.sh
 
 # Run RStudio
 CMD ["/init"]

scripts/install_cran_pkgs.R

@@ -53,177 +53,6 @@ pharmaverse_pkgs <- c(
 
 # Regular CRAN packages to install
 shared_pkgs <- c(
-  "assertthat",
-  "bayesplot",
-  "BayesPPD",
-  "bbmle",
-  "bdsmatrix",
-  "bigD",
-  "binom",
-  "bookdown",
-  "broom",
-  "broom.helpers",
-  "callr",
-  "car",
-  "checkmate",
-  "chk",
-  "circlize",
-  "cli",
-  "cobalt",
-  "colourpicker",
-  "covr",
-  "cowplot",
-  "crayon",
-  "DBI",
-  "DescTools",
-  "deSolve",
-  "devtools",
-  "dfoptim",
-  "DiagrammeR",
-  "diffdf",
-  "digest",
-  "dm",
-  "dplyr",
-  "duckdb",
-  "DT",
-  "emmeans",
-  "EnvStats",
-  "fastGHQuad",
-  "flexsurv",
-  "flextable",
-  "forcats",
-  "formatters",
-  "formula.tools",
-  "fs",
-  "gbm",
-  "gdtools",
-  "geeasy",
-  "geepack",
-  "GenSA",
-  "gert",
-  "GGally",
-  "ggExtra",
-  "ggfortify",
-  "ggiraph",
-  "ggmosaic",
-  "ggnewscale",
-  "ggplot2",
-  "ggpmisc",
-  "ggpubr",
-  "ggrepel",
-  "gh",
-  "git2r",
-  "glmmTMB",
-  "globals",
-  "glue",
-  "goftest",
-  "gridExtra",
-  "gt",
-  "gtable",
-  "gtsummary",
-  "here",
-  "htmltools",
-  "httr",
-  "huxtable",
-  "igraph",
-  "jsonlite",
-  "juicyjuice",
-  "kableExtra",
-  "knitr",
-  "labeling",
-  "lifecycle",
-  "lintr",
-  "lme4",
-  "lmerTest",
-  "lmtest",
-  "logger",
-  "maditr",
-  "magick",
-  "magrittr",
-  "markdown",
-  "MatchIt",
-  "matrixcalc",
-  "mcr",
-  "mockery",
-  "mstate",
-  "muhaz",
-  "nloptr",
-  "nomnoml",
-  "nortest",
-  "odbc",
-  "officer",
-  "operator.tools",
-  "optimx",
-  "oysteR",
-  "parglm",
-  "patchwork",
-  "pbkrtest",
-  "pillar",
-  "pkgdown",
-  "png",
-  "purrr",
-  "quarto",
-  "r2rtf",
-  "R6",
-  "randomForest",
-  "rbmi",
-  "rcmdcheck",
-  "Rcpp",
-  "RcppNumerical",
-  "RcppProgress",
-  "Rdpack",
-  "readr",
-  "readxl",
-  "remotes",
-  "renv",
-  "reticulate",
-  "rjags",
-  "rJava",
-  "RJDBC",
-  "rlang",
-  "rmarkdown",
-  "rstan",
-  "rstantools",
-  "rstpm2",
-  "rsvg",
-  "rvest",
-  "scales",
-  "shiny",
-  "shinyjs",
-  "shinyRadioMatrix",
-  "shinytest",
-  "shinytest2",
-  "shinyTree",
-  "shinyvalidate",
-  "shinyWidgets",
-  "shinylive",
-  "simsurv",
-  "sparkline",
-  "spelling",
-  "ssh",
-  "statmod",
-  "stringi",
-  "styler",
-  "survminer",
-  "table1",
-  "testthat",
-  "tibble",
-  "tidyr",
-  "tidyselect",
-  "tinytest",
-  "tinytex",
-  "tfrmt",
-  "tzdb",
-  "uuid",
-  "V8",
-  "vdiffr",
-  "viridisLite",
-  "vistime",
-  "vroom",
-  "webshot",
-  "WeightIt",
-  "withr",
-  "xfun",
   "xml2",
   "yaml"
 )
@@ -237,8 +66,7 @@ local_dev_packages <- c(
 # Collate all packages
 cran_pkgs <- list(
   rstudio = c(
-    shared_pkgs,
-    pharmaverse_pkgs
+    shared_pkgs
   ),
   `rstudio-local` = c(
     shared_pkgs,