build-and-push.yaml

# Builds and pushes docker images on main and tags

name: Build and Push Docker images
on:
  push:
    branches:
      - main
      - "release/**"
    paths:
      - "Makefile"
      - "pom.xml"
      - ".github/workflows/build-and-push.yaml"
      - "config"
      - "src/**"
    tags:
      - '*'

jobs:
  build:
    if: github.repository == 'geoserver/geoserver-cloud'
    name: Build and Push
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
    - name: Install Cosign
      uses: sigstore/cosign-installer@v3.5.0

    - name: Login to Docker Hub
      uses: docker/login-action@v1
      with:
        username: ${{ secrets.DOCKER_HUB_USERNAME }}
        password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}

    - name: Checkout
      uses: actions/checkout@v2
      with:
        submodules: recursive

    - name: Setup Java
      uses: actions/setup-java@v2
      with:
        distribution: 'temurin'
        java-version: '21'
        cache: 'maven'

    - name: Build without tests
      run: |
        make install

    - name: Build images
      run: |
        make build-image

    - name: Push images
      run: |
        make push-image

    - name: Remove project jars from cached repository
      run: |
        rm -rf ~/.m2/repository/org/geoserver
        find ~/.m2/repository -name "*SNAPSHOT*" -type d | xargs rm -rf {}

    - name: Sign images
      if: ${{ startsWith(github.ref, 'refs/tags/') }}
      env:
        COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
        COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
      run: |
        make sign-image

    - name: Verify image signatures
      if: ${{ startsWith(github.ref, 'refs/tags/') }}
      env:
        COSIGN_PUB_KEY: ${{ secrets.COSIGN_PUB_KEY }}
        COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
      run: |
        make verify-image