Fix docker image signing v2 (#32956)

* Tweak cd.yaml workflow

* Tweak cd.yaml workflow

* Iterate

* Iterate

* Iterate

* Iterate

* Remove debug

.github/workflows/cd.yaml

@@ -21,11 +21,6 @@ jobs:
         steps:
             - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
               with:
-                  # We need to fetch all branches and commits so that Nx affected has a base to compare against.
-                  fetch-depth: 0
-                  # reduce the size of the checkout with tree filtering,
-                  # see https://github.blog/open-source/git/get-up-to-speed-with-partial-clone-and-shallow-clone/
-                  filter: tree:0
                   persist-credentials: false
 
             - name: Install Cosign
@@ -54,17 +49,20 @@ jobs:
                   username: ${{ github.repository_owner }}
                   password: ${{ secrets.GITHUB_TOKEN }}
 
-            - run: pnpm nx run-many -t docker:build
+            - run: pnpm nx run-many --nxBail -t docker:build
+              id: build
               env:
                   INPUT_PUSH: true
+                  INPUT_LOAD: false
                   INPUT_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                   INPUT_BUILDER: ${{ steps.builder.outputs.name }}
 
             - name: Sign the images with GitHub OIDC token
-              env:
-                  PATTERN: "^ghcr.io/element-hq/element-web*"
               run: |
-                  docker image ls --digests --format '{{.Repository}}@{{.Digest}}' | grep "$PATTERN" | while read -r TARGET; do
+                  shopt -s globstar
+
+                  for FILE in ./node_modules/.cache/nx-container/**/metadata; do
+                      TARGET=$(jq -r '.["image.name"] + "@" + .["containerimage.digest"]' "$FILE")
                       echo "Signing $TARGET..."
                       cosign sign --yes "$TARGET"
                   done

apps/desktop/project.json

@@ -5,15 +5,14 @@
     "targets": {
         "docker:build": {
             "executor": "@nx-tools/nx-container:build",
-            "dependsOn": ["docker:prebuild"],
             "options": {
                 "load": true,
                 "engine": "docker",
                 "platforms": ["linux/amd64", "linux/arm64"],
                 "provenance": "true",
                 "sbom": true,
-                "context": "apps/desktop",
+                "context": "{projectRoot}",
-                "file": "apps/desktop/dockerbuild/Dockerfile",
+                "file": "{projectRoot}/dockerbuild/Dockerfile",
                 "metadata": {
                     "images": ["ghcr.io/element-hq/element-web/desktop-build-env"],
                     "tags": ["type=ref,event=branch"]

packages/playwright-common/project.json

@@ -20,10 +20,10 @@
                 "provenance": "true",
                 "sbom": true,
                 "build-args": ["PLAYWRIGHT_VERSION=$PLAYWRIGHT_VERSION"],
-                "context": "packages/playwright-common",
+                "context": "{projectRoot}",
                 "metadata": {
                     "images": ["ghcr.io/element-hq/element-web/playwright-server"],
-                    "tags": ["type=raw,enable={{is_default_branch}},value=$PLAYWRIGHT_VERSION"]
+                    "tags": ["type=ref,event=branch", "type=raw,enable={{is_default_branch}},value=$PLAYWRIGHT_VERSION"]
                 }
             }
         }