docker-release.yml

name: Docker

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

on:
    #push:
        #    branches: [main]
        # Publish semver tags as releases.
        #tags: ['v*.*.*']
    pull_request:
        branches: [main]
    release:
        types: [published]
    workflow_dispatch:

permissions:
      contents: read
      packages: write
      id-token: write


env:
    # Use docker.io for Docker Hub if empty
    REGISTRY: ghcr.io
    # github.repository as <account>/<repo>
    IMAGE_NAME: ${{ github.repository }}

jobs:
    docker-build:
        if: ${{ !contains(github.event.head_commit.message, 'skip ci') && !contains(github.event.head_commit.message, 'skip release') }}
        runs-on: ubuntu-latest
        permissions:
            contents: read
            packages: write
            # This is used to complete the identity challenge
            # with sigstore/fulcio when running outside of PRs.
            id-token: write

        steps:
            - name: '☁️ Checkout repository'
              uses: actions/checkout@v4

            # Install the cosign tool except on PR
            # https://github.com/sigstore/cosign-installer
            - name: '📦️ Install cosign'
              if: github.event_name != 'pull_request'
              uses: sigstore/cosign-installer@main
              with:
                  cosign-release: 'v2.1.1'

            # Workaround: https://github.com/docker/build-push-action/issues/461
            - name: '🔧 Setup Docker buildx'
              uses: docker/setup-buildx-action@2b51285047da1547ffb1b2203d8be4c0af6b1f20

            # Login against a Docker registry except on PR
            # https://github.com/docker/login-action
            - name: '🔐 Log into registry ${{ env.REGISTRY }}'
              if: github.event_name != 'pull_request'
              uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20
              with:
                  registry: ${{ env.REGISTRY }}
                  username: ${{ github.actor }}
                  password: ${{ secrets.GITHUB_TOKEN }}

            # Extract metadata (tags, labels) for Docker
            # https://github.com/docker/metadata-action
            - name: '📦️ Extract Docker metadata'
              id: meta
              uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81
              with:
                  images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

            # Build and push Docker image with Buildx (don't push on PR)
            # https://github.com/docker/build-push-action
            - name: '🏗️ Build and push Docker image'
              id: build-and-push
              uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0
              with:
                  context: .
                  push: ${{ github.event_name != 'pull_request' }}
                  tags: ${{ steps.meta.outputs.tags }}
                  labels: ${{ steps.meta.outputs.labels }}

            # Sign the resulting Docker image digest except on PRs.
            # This will only write to the public Rekor transparency log when the Docker
            # repository is public to avoid leaking data.  If you would like to publish
            # transparency data even for private images, pass --force to cosign below.
            # https://github.com/sigstore/cosign
            - name: '✍️ Sign the published Docker image'
              if: ${{ github.event_name != 'pull_request' }}
              env:
                  # COSIGN_EXPERIMENTAL: 'true'
                  TAGS: ${{ steps.meta.outputs.tags }}
                  DIGEST: ${{ steps.build-and-push.outputs.digest }}
              # This step uses the identity token to provision an ephemeral certificate
              # against the sigstore community Fulcio instance.
              run: cosign sign --yes "${TAGS}@${DIGEST}"