build_and_publish.yaml

name: Build and sign image
on:
  push:
    branches:
      - main

jobs:
  build-image:
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write
      security-events: write

    name: build-image
    env:
      IMAGE_NAME: ghcr.io/shellz-n-stuff/slsa-spring-demo
      IMAGE_TAG: ${{ github.sha }}

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Set up Cosign
      uses: sigstore/cosign-installer@v3.5.0

    - name: Set up Java 17
      uses: actions/setup-java@v3
      with:
        distribution: 'zulu'
        java-version: '17'
        cache: 'gradle'
      
    - name: Install Syft
      run: |
        curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin

    - name: Login to GitHub Container Registry
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Build with Gradle and Jib
      run: ./gradlew build jibDockerBuild --image=${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}

    - name: Push Docker Image to GHCR
      run: |
        docker push ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
    
    - name: Get Image Digest
      id: image-digest
      run: |
        DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }})
        echo "DIGEST=${DIGEST}" >> $GITHUB_ENV

    # SBOM generation and scanning
    - name: Generate SBOM
      run: syft ${{ env.IMAGE_NAME }}::${{ env.IMAGE_TAG }} -o json > sbom.json

    - name: Scan SBOM with Grype
      run: grype sbom:sbom.json --output sarif > grype-report.sarif

    - name: Upload Grype Report as SARIF
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: grype-report.sarif

    - name: Sign Docker Image + SBOM with Cosign
      env:
        COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
      run: |
         cosign sign -a COMMIT=${{env.IMAGE_TAG}} -a GITHUB_REPO=${{ github.repository }} -a AUTHOR=${{github.actor}} -a REF=${{github.ref}} -a JOB_ID=${{github.job}} --yes --key <(echo "${{ secrets.COSIGN_PRIVATE_KEY }}") ${{ env.DIGEST }}
         cosign attest --yes --key <(echo "${{ secrets.COSIGN_PRIVATE_KEY }}") --predicate sbom.json  ${{ env.DIGEST }}