ci.yaml

name: ci

on:
  push:
    branches: [master]
  release:
    types: [created]
  pull_request:
    branches: [master]

# Declare default permissions as read only.
permissions: read-all

jobs:
  build:
    name: build
    runs-on: ubuntu-22.04
    permissions:
      packages: write
    outputs:
      image-tags: ${{ steps.container_meta.outputs.tags }}
      image-digest: ${{ steps.build.outputs.digest }}
    steps:
      - name: Docker meta
        id: container_meta
        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5
        with:
          images: |
            ghcr.io/${{ github.repository }}
            docker.io/${{ github.repository }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3

      - name: Login to DockerHub
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3
        if: github.event_name != 'pull_request'
        with:
          username: chgl
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3
        if: github.event_name != 'pull_request'
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        id: build
        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5
        with:
          cache-from: type=gha
          cache-to: type=gha,mode=max
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.container_meta.outputs.tags }}
          labels: ${{ steps.container_meta.outputs.labels }}

  release:
    if: ${{ github.event_name != 'pull_request' }}
    needs: build
    name: Release
    runs-on: ubuntu-22.04
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Checkout
        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
        with:
          # via <https://stackoverflow.com/questions/74744498/github-pushing-to-protected-branches-with-fine-grained-token/76550826#76550826>
          persist-credentials: false

      # Only required temporary: https://github.com/cycjimmy/semantic-release-action/issues/159
      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
        with:
          node-version: 14

      - name: Semantic Release
        uses: cycjimmy/semantic-release-action@61680d0e9b02ff86f5648ade99e01be17f0260a4 # v4.0.0
        with:
          extra_plugins: |
            conventional-changelog-conventionalcommits@5.0.0
            semantic-release-replace-plugin@1.2.0
            @semantic-release/git@10.0.1
        env:
          GITHUB_TOKEN: ${{ secrets.CI_SEMANTIC_RELEASE_TOKEN }}

  sign-images:
    if: ${{ github.event_name != 'pull_request' }}
    name: sign images
    runs-on: ubuntu-22.04
    needs:
      - build
    permissions:
      id-token: write
      packages: write
    steps:
      - name: Login to GitHub Container Registry
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Login to DockerHub
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3
        if: github.event_name != 'pull_request'
        with:
          registry: docker.io
          username: chgl
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Install Cosign
        uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 # tag=v3

      - name: Sign image
        env:
          # <https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable>
          TAGS: ${{ needs.build.outputs.image-tags }}
          DIGEST: ${{ needs.build.outputs.image-digest }}
        run: |
          echo "${TAGS}" | xargs -I {} cosign sign --yes {}@"${DIGEST}"

  ghcr-io-provenance:
    if: ${{ startsWith(github.ref, 'refs/tags/') }}
    needs:
      - build
    permissions:
      actions: read # for detecting the Github Actions environment.
      # kics-scan ignore-line
      id-token: write # for creating OIDC tokens for signing.
      packages: write # for uploading attestations.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.9.0
    with:
      image: "ghcr.io/${{ github.repository }}"
      digest: ${{ needs.build.outputs.image-digest }}
      registry-username: ${{ github.actor }}
    secrets:
      registry-password: "${{ secrets.GITHUB_TOKEN }}"

  docker-io-provenance:
    if: ${{ startsWith(github.ref, 'refs/tags/') }}
    needs:
      - build
    permissions:
      actions: read # for detecting the Github Actions environment.
      # kics-scan ignore-line
      id-token: write # for creating OIDC tokens for signing.
      packages: write # for uploading attestations.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.9.0
    with:
      image: "docker.io/${{ github.repository }}"
      digest: ${{ needs.build.outputs.image-digest }}
      registry-username: chgl
    secrets:
      registry-password: "${{ secrets.DOCKERHUB_TOKEN }}"