Connect the registries, identity and systems your deploys touch

import { step } from "@girder/sdk";

export const publishImage = step({
  name: "publish_image",
  // Inputs are hashed; anything not declared here cannot be read.
  inputs: {
    artifact: artifactRef(),
    registry: env("REGISTRY_HOST"),
  },
  outputs: { digest: z.string() },
  // Pushes to a shared registry, so it never runs unapproved.
  policy: { requiresApproval: true, environments: ["staging", "production"] },
  async run({ artifact, registry }, ctx) {
    const { digest } = await ctx.oci.push(artifact, registry);
    await ctx.attest({ subject: digest, predicate: "publish" });
    return { digest };
  },
});