Update Docker registry to GHCR (#202)

.github/workflows/build.yml

@@ -39,7 +39,7 @@ jobs:
 
   build-docker:
     name: Build Docker images
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     needs: build-artifacts
     permissions:
       security-events: write
@@ -47,7 +47,6 @@ jobs:
     env:
       _AZ_REGISTRY: bitwardenprod.azurecr.io
       _PROJECT_NAME: key-connector
-
     steps:
       - name: Check out repo
         uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1

.github/workflows/publish.yml

@@ -21,7 +21,7 @@ on:
 jobs:
   setup:
     name: Setup
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     outputs:
       release-version: ${{ steps.version-output.outputs.version }}
     steps:
@@ -39,14 +39,19 @@ jobs:
 
   publish-docker:
     name: Publish Docker images
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     needs: setup
     env:
       _AZ_REGISTRY: bitwardenprod.azurecr.io
       _PROJECT_NAME: key-connector
       _RELEASE_VERSION: ${{ needs.setup.outputs.release-version }}
-
+    permissions:
+      id-token: write
+      packages: write
     steps:
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
+
       - name: Log in to Azure
         uses: Azure/login@e15b166166a8746d1a47596803bd8c1b595455cf # v1.6.0
         with:
@@ -55,12 +60,12 @@ jobs:
       - name: Log in to ACR
         run: az acr login -n ${_AZ_REGISTRY%.azurecr.io}
 
-      - name: Set up DCT
-        id: setup-dct
-        uses: bitwarden/gh-actions/setup-docker-trust@main
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
-          azure-creds: ${{ secrets.AZURE_KV_CI_SERVICE_PRINCIPAL }}
-          azure-keyvault-name: "bitwarden-ci"
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Pull image
         run: docker pull $_AZ_REGISTRY/$_PROJECT_NAME:dev
@@ -68,13 +73,13 @@ jobs:
       - name: Tag version and latest
         run: |
           if [[ "${{ inputs.publish_type }}" == "Dry Run" ]]; then
-            docker tag $_AZ_REGISTRY/$_PROJECT_NAME:dev bitwarden/$_PROJECT_NAME:dryrun
+            docker tag $_AZ_REGISTRY/$_PROJECT_NAME:dev ghcr.io/bitwarden/$_PROJECT_NAME:dryrun
           else
             docker tag $_AZ_REGISTRY/$_PROJECT_NAME:dev $_AZ_REGISTRY/$_PROJECT_NAME:$_RELEASE_VERSION
             docker tag $_AZ_REGISTRY/$_PROJECT_NAME:dev $_AZ_REGISTRY/$_PROJECT_NAME:latest
 
-            docker tag $_AZ_REGISTRY/$_PROJECT_NAME:dev bitwarden/$_PROJECT_NAME:$_RELEASE_VERSION
-            docker tag $_AZ_REGISTRY/$_PROJECT_NAME:dev bitwarden/$_PROJECT_NAME:latest
+            docker tag $_AZ_REGISTRY/$_PROJECT_NAME:dev ghcr.io/bitwarden/$_PROJECT_NAME:$_RELEASE_VERSION
+            docker tag $_AZ_REGISTRY/$_PROJECT_NAME:dev ghcr.io/bitwarden/$_PROJECT_NAME:latest
           fi
 
       - name: Push release version and latest image to ACR
@@ -83,14 +88,30 @@ jobs:
           docker push $_AZ_REGISTRY/$_PROJECT_NAME:$_RELEASE_VERSION
           docker push $_AZ_REGISTRY/$_PROJECT_NAME:latest
 
-      - name: Push release version and latest image to Docker Hub
+      - name: Push release version and latest image
         if: ${{ inputs.publish_type != 'Dry Run' }}
-        env:
-          DOCKER_CONTENT_TRUST: 1
-          DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: ${{ steps.setup-dct.outputs.dct-delegate-repo-passphrase }}
         run: |
-          docker push bitwarden/$_PROJECT_NAME:$_RELEASE_VERSION
-          docker push bitwarden/$_PROJECT_NAME:latest
+          docker push ghcr.io/bitwarden/$_PROJECT_NAME:$_RELEASE_VERSION
+          docker push ghcr.io/bitwarden/$_PROJECT_NAME:latest
+
+      - name: Sign image with Cosign
+        run: |
+          cosign sign --yes ghcr.io/bitwarden/$_PROJECT_NAME:$_RELEASE_VERSION
+          cosign sign --yes ghcr.io/bitwarden/$_PROJECT_NAME:latest
+
+      - name: Verify the signed image with Cosign
+        run: |
+          cosign verify \
+            --certificate-identity "${{ github.server_url }}/${{ github.workflow_ref }}" \
+            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+            ghcr.io/bitwarden/$_PROJECT_NAME:$_RELEASE_VERSION
+
+          cosign verify \
+            --certificate-identity "${{ github.server_url }}/${{ github.workflow_ref }}" \
+            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+            ghcr.io/bitwarden/$_PROJECT_NAME:latest
 
       - name: Log out of Docker
-        run: docker logout
+        run: |
+          docker logout ghcr.io
+          docker logout $_AZ_REGISTRY

README.md

@@ -1,7 +1,3 @@
-<a href="https://hub.docker.com/r/bitwarden/key-connector" target="_blank">
-  <img src="https://img.shields.io/docker/pulls/bitwarden/key-connector.svg" alt="DockerHub" />
-</a>
-
 # Bitwarden Key Connector
 
 The Bitwarden Key Connector is a self-hosted web application that stores and provides cryptographic keys to Bitwarden
@@ -13,7 +9,7 @@ and deployed cross-platform on Windows, macOS, and Linux distributions.
 ## Deploy
 
 The Bitwarden Key Connector can be deployed using the pre-built docker container available on
-[DockerHub](https://hub.docker.com/r/bitwarden/key-connector).
+[ghcr.io](https://github.com/bitwarden/self-host/pkgs/container/key-connector).
 
 ## Configuration