From 29ff2fef519ff3dfeabb1a988e7a3e25eebbd781 Mon Sep 17 00:00:00 2001
From: Jeremy Bernard <jeremy.bernard@iex.ec>
Date: Tue, 29 Sep 2026 16:12:42 +0200
Subject: [PATCH] feat(docker-build): upload image tag as an artifact and
 publish summary

---
 .github/workflows/docker-build.yml | 37 +++++++++++++++++++++++++++++-
 docker-build/README.md             |  9 ++++++++
 docker-build/workflow-sha256       |  2 +-
 3 files changed, 46 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 79c42ca..de5b753 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -90,6 +90,7 @@ jobs:
     env:
       PLATFORM: ${{ inputs.platform }}
       OCI_IMAGE: ${{ inputs.image-name }}:${{ inputs.image-tag }}
+      IMAGE_TAG: ${{ inputs.image-tag }}
       REPORT_MODE: ${{ inputs.security-report }}
 
     steps:
@@ -270,6 +271,19 @@ jobs:
         if: ${{ inputs.push }}
         run: docker push "$OCI_IMAGE"
 
+      - name: Record the pushed image tag
+        run: |
+          echo "$IMAGE_TAG" > image-tag.txt
+
+      # The promote workflow runs from a separate tag push and reads this artifact
+      # from the CI run, instead of reconstructing the tag from a prefix.
+      - name: Upload the image tag for the promote workflow
+        if: ${{ inputs.push }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: docker-image-tag
+          path: image-tag.txt
+
       - name: Compute checksum of the Docker image
         id: checksum
         run: |
@@ -279,6 +293,27 @@ jobs:
           echo "checksum=0x${DIGEST}" >> "$GITHUB_OUTPUT"
           echo "digest=sha256:${DIGEST}" >> "$GITHUB_OUTPUT"
 
+      - name: Summarise the build
+        env:
+          PUSH: ${{ inputs.push }}
+          REGISTRY: ${{ inputs.registry }}
+          DIGEST: ${{ steps.checksum.outputs.digest }}
+          CHECKSUM: ${{ steps.checksum.outputs.checksum }}
+        run: |
+          {
+            echo "### 🐳 Built \`$OCI_IMAGE\`"
+            echo ""
+            echo "<table><tbody>"
+            echo "<tr><td><b>Platform</b></td><td>$PLATFORM</td></tr>"
+            echo "<tr><td><b>Registry</b></td><td>$REGISTRY</td></tr>"
+            echo "<tr><td><b>Digest</b></td><td><code>$DIGEST</code></td></tr>"
+            echo "<tr><td><b>Checksum</b></td><td><code>$CHECKSUM</code></td></tr>"
+            if [ "$PUSH" = "true" ]; then
+              echo "<tr><td><b>Pushed</b></td><td>✅</td></tr>"
+            fi
+            echo "</tbody></table>"
+          } >> "$GITHUB_STEP_SUMMARY"
+
       # --- SLSA provenance attestation -----
       # Requires the permissions id-token: write + attestations: write.
       - name: Generate & sign SLSA provenance (keyless)
@@ -292,5 +327,5 @@ jobs:
       - name: Cleanup files
         if: always()
         run: |
-          rm -f trivy.txt trivy-results.sarif
+          rm -f trivy.txt trivy-results.sarif image-tag.txt
           docker image rm -f "$OCI_IMAGE"
diff --git a/docker-build/README.md b/docker-build/README.md
index 3adecb7..86e090e 100644
--- a/docker-build/README.md
+++ b/docker-build/README.md
@@ -53,6 +53,14 @@ Perfect for teams looking to streamline their containerization workflow with min
 | `username`           | Username for Docker Registry authentication                                                         | When `push: true`  |
 | `password`           | Password or Personal Access Token for Docker registry authentication (with appropriate permissions) | When `push: true`  |
 
+## 📤 Outputs
+
+| Name | Description |
+| --- | --- |
+| `checksum` | Checksum (`0x...`) of the Docker image |
+
+The built image tag, digest and checksum are visible on the workflow run summary.
+
 ## 💻 Example Usage
 
 ```yaml
@@ -93,6 +101,7 @@ jobs:
 - 🔒 Ensure your Docker Registry credentials are stored securely as GitHub Secrets
 - 🔄 The workflow will automatically handle the Docker build and push process
 - 🏷️ You can specify any valid Docker tag format in the `tag` input
+- 📤 When `push: true`, the applied tag is also saved as a `docker-image-tag` artifact, so `docker-promote` can promote the exact image CI built for a commit rather than reconstruct its tag
 - 📅 Consider using dynamic tags based on git tags, commit SHAs, or dates
 - 🧪 For testing purposes, you can use the `--dry-run` flag in your own implementation
 - 📜 When `attest: true`, the attestation is only generated if `push: true`, and the **caller** workflow must grant the following permissions:
diff --git a/docker-build/workflow-sha256 b/docker-build/workflow-sha256
index e87f754..9ebf4b3 100644
--- a/docker-build/workflow-sha256
+++ b/docker-build/workflow-sha256
@@ -1 +1 @@
-b90cf70ccbf64901db2b79cf2d320010efb34e714ff2e270d03ff2d181fa3845
+5dbd7ebf692640348daeb31bcda91bd49e7e08f628db14d00deaa28fb29f3cc9