docker publish changes

Author: Suresh Mandalapu

.github/workflows/docker-publish.yml

@@ -26,7 +26,7 @@ jobs:
           CLEANCLOUD_VERSION="${{ steps.version.outputs.CLEANCLOUD_VERSION }}"
           echo "Waiting for cleancloud==${CLEANCLOUD_VERSION} to appear on PyPI..."
           for i in $(seq 1 20); do
-            curl -sf "https://pypi.org/pypi/cleancloud/${CLEANCLOUD_VERSION}/json" > /dev/null && echo "Found on PyPI" && exit 0
+            curl -sf --retry 3 --retry-delay 5 "https://pypi.org/pypi/cleancloud/${CLEANCLOUD_VERSION}/json" > /dev/null && echo "Found on PyPI" && exit 0
             echo "Not yet available (attempt $i/20), retrying in 30s..."
             sleep 30
           done
@@ -52,14 +52,13 @@ jobs:
           tags: |
             type=semver,pattern={{version}}
             type=semver,pattern=v{{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-            type=raw,value=latest
+            type=raw,value=latest,enable=${{ !github.event.release.prerelease }}
           labels: |
-            org.opencontainers.image.description=Read-only cloud hygiene scanner for AWS and Azure
+            org.opencontainers.image.description=Read-only cloud hygiene scanner for AWS, Azure, and GCP
             org.opencontainers.image.licenses=MIT
 
       - name: Build and push
+        id: build
         uses: docker/build-push-action@v6
         with:
           context: .
@@ -71,15 +70,28 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+          provenance: true
+          sbom: true
+
+      - name: Log image digest
+        run: echo "Image digest ${{ steps.build.outputs.digest }}"
 
       - name: Update release notes with Docker info
         uses: actions/github-script@v7
         with:
           script: |
             const version = '${{ steps.version.outputs.CLEANCLOUD_VERSION }}';
+            const digest = '${{ steps.build.outputs.digest }}';
             const currentBody = context.payload.release.body || '';
+
+            // Idempotent: skip if Docker section already present (workflow rerun guard)
+            if (currentBody.includes('🐳 **Docker Image**')) {
+              console.log('Docker section already present, skipping update.');
+              return;
+            }
+
             const safeBody = currentBody.endsWith('\n') ? currentBody : currentBody + '\n';
-            const dockerInfo = `\n🐳 **Docker Image**\n\n\`\`\`bash\n# AWS\ndocker run --rm -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_SESSION_TOKEN -e AWS_REGION getcleancloud/cleancloud scan --provider aws --all-regions\n\n# Azure\ndocker run --rm -e AZURE_CLIENT_ID -e AZURE_TENANT_ID -e AZURE_SUBSCRIPTION_ID -e AZURE_FEDERATED_TOKEN_FILE -v "\${AZURE_FEDERATED_TOKEN_FILE}:\${AZURE_FEDERATED_TOKEN_FILE}:ro" getcleancloud/cleancloud scan --provider azure\n\`\`\`\n\n📦 Pull: \`docker pull getcleancloud/cleancloud:${version}\`\n🔗 Docker Hub: https://hub.docker.com/r/getcleancloud/cleancloud`;
+            const dockerInfo = `\n🐳 **Docker Image**\n\n\`\`\`bash\n# AWS\ndocker run --rm -e AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY -e AWS_SESSION_TOKEN -e AWS_REGION getcleancloud/cleancloud scan --provider aws --all-regions\n\n# Azure\ndocker run --rm -e AZURE_CLIENT_ID -e AZURE_TENANT_ID -e AZURE_SUBSCRIPTION_ID -e AZURE_FEDERATED_TOKEN_FILE -v "\${AZURE_FEDERATED_TOKEN_FILE}:\${AZURE_FEDERATED_TOKEN_FILE}:ro" getcleancloud/cleancloud scan --provider azure\n\n# GCP (WIF or service account key)\ndocker run --rm -e GOOGLE_APPLICATION_CREDENTIALS=/gcp-creds.json -v "\${GOOGLE_APPLICATION_CREDENTIALS}:/gcp-creds.json:ro" getcleancloud/cleancloud scan --provider gcp --all-projects\n\`\`\`\n\n📦 Pull: \`docker pull getcleancloud/cleancloud:${version}\`\n🔗 Docker Hub: https://hub.docker.com/r/getcleancloud/cleancloud\n🔏 Digest: \`${digest}\``;
 
             await github.rest.repos.updateRelease({
               owner: context.repo.owner,

docs/ci.md

@@ -240,15 +240,46 @@ jobs:
 
 > Azure Workload Identity writes an OIDC token to a temp file on the runner. The `-v` mount makes that file accessible inside the container.
 
+### GCP
+
+GCP Application Default Credentials are resolved via a file-based mechanism. In GitHub Actions with Workload Identity Federation, `google-github-actions/auth@v2` exchanges the OIDC token and writes a short-lived credentials file to the runner filesystem, then sets `GOOGLE_APPLICATION_CREDENTIALS` to point to it. That file must be mounted into the container.
+
+```yaml
+jobs:
+  cleancloud:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
+
+      - name: Run CleanCloud
+        run: |
+          test -f "$GOOGLE_APPLICATION_CREDENTIALS" || exit 1
+          echo "Using GCP credentials at: $GOOGLE_APPLICATION_CREDENTIALS"
+
+          docker run --rm \
+            -e GOOGLE_APPLICATION_CREDENTIALS=/gcp-creds.json \
+            -v "$GOOGLE_APPLICATION_CREDENTIALS:/gcp-creds.json:ro" \
+            getcleancloud/cleancloud scan \
+              --provider gcp \
+              --all-projects \
+              --fail-on-confidence HIGH \
+              --fail-on-cost 100
+```
+
+> The credentials file is short-lived and mounted read-only — no long-lived keys are exposed. The `test -f` guard catches a silent auth failure before Docker attempts the mount.
+
 ### Pinning to a specific version
 
 ```yaml
 # Pin to exact version — safest for production pipelines
 getcleancloud/cleancloud:1.9.0
 
-# Pin to minor — gets patch fixes automatically
-getcleancloud/cleancloud:1.9
-
 # Always latest — simplest, least predictable
 getcleancloud/cleancloud:latest
 ```
@@ -667,7 +698,7 @@ cleancloud scan \
 
 **JSON is the recommended format for programmatic processing** as it contains complete data including evidence and detailed metadata.
 
-The JSON output follows a versioned schema (see `schemas/output-v1.0.0.json`) and varies slightly between providers to accommodate their different organizational models (AWS regions vs Azure subscriptions).
+The JSON output follows a versioned schema (see `schemas/output-v1.2.0.json`) and varies slightly between providers to accommodate their different organizational models (AWS regions vs Azure subscriptions).
 
 **AWS Schema Example:**
 ```json