ci.yml

name: compage-template-python-ci
on:
  push:
    branches:
      - main
jobs:
  build-and-push:
    permissions:
      id-token: write  # Required for keyless signing
      contents: read
    runs-on: ubuntu-latest
    env:
      REGISTRY: ghcr.io
      GH_URL: https://github.com
    steps:
      - name: Check out the repo
        uses: actions/checkout@v4
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GH_TOKEN }}
      - name: Create JSON file
        run: |
          cat <<EOF > /tmp/annotations.json
          {
          "\$manifest": {
               "org.opencontainers.image.authors": "${{ github.actor }}",
               "org.opencontainers.image.url": "${{ env.REGISTRY }}/${{ github.repository }}",
               "org.opencontainers.image.source": "https://github.com/intelops/compage-template-python",
               "org.opencontainers.image.version": "${{ github.run_id }}",
               "org.opencontainers.image.vendor": "Intelops Inc.",
               "org.opencontainers.image.licenses": "Apache License Version 2.0",
               "org.opencontainers.image.title": "compage-template-python",
               "org.opencontainers.image.description": "The compage-template-python has templates for python"
            }
          }
          EOF
      - uses: oras-project/setup-oras@v1
        with:
          version: 1.1.0
      - run: |
          oras push --annotation-file /tmp/annotations.json ${{ env.REGISTRY }}/${{ github.repository }}:${{ github.run_id }} ./:application/vnd.common.templates.layer.v1+tar

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3.3.0
      - name: Check install!
        run: cosign version
      - name: Sign the images
        run: |
          cosign sign -y ${{ env.REGISTRY }}/${{ github.repository }}:${{ github.run_id }}
        env:
          COSIGN_EXPERIMENTAL: 1
      - name: Verify the pushed tags
        run: |
          cosign verify ${{ env.REGISTRY }}/${{ github.repository }}:${{ github.run_id }} --certificate-identity ${{ env.GH_URL }}/${{ github.repository }}/.github/workflows/ci.yml@refs/heads/main --certificate-oidc-issuer https://token.actions.githubusercontent.com
        env:
          COSIGN_EXPERIMENTAL: 1
      - name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          format: 'github'
          output: 'dependency-results.sbom.json'
          image-ref: '.'
          github-pat: ${{ secrets.GH_TOKEN }}