oci-auth-cd.yaml

name: CD / OCI Authentication Sidecar

on:
  pull_request:
    branches:
      - "master"
    paths:
      - "go/oci-auth/**"
  push:
    tags:
    - 'v*.*.*'

permissions:
  contents: read

env:
  GOPATH: /home/runner/go
  GOBIN: /home/runner/go/bin
  GOPROXY: "https://proxy.golang.org"

jobs:
  test:
    name: Unit test
    runs-on: ubuntu-20.04
    defaults:
      run:
        shell: bash
        working-directory: go/oci-auth
    timeout-minutes: 5
    steps:
    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
    - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
      with:
        go-version-file: go/oci-auth/go.mod
        cache: true
    - run: go mod download
    - run: PATH=$PATH:$GOPATH/bin make --directory=.. tools
    - run: PATH=$PATH:$GOPATH/bin make test
  publish-docker:
    name: Build and push oci-auth container
    runs-on: ubuntu-20.04
    defaults:
      run:
        shell: bash
        working-directory: go/oci-auth
    needs: [ test ]
    permissions:
      contents: 'read'
      id-token: 'write'
      packages: 'write'
    steps:
    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      with:
        fetch-depth: 0
    - id: meta
      uses: docker/metadata-action@v5
      with:
        images: |
          ghcr.io/pluralsh/oci-auth
          gcr.io/pluralsh/oci-auth
          docker.io/pluralsh/oci-auth
    - uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.repository_owner }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - uses: google-github-actions/auth@v1
      with:
        workload_identity_provider: 'projects/${{ secrets.GOOGLE_PROJECT_ID }}/locations/global/workloadIdentityPools/github/providers/github'
        service_account: 'terraform@pluralsh.iam.gserviceaccount.com'
        token_format: 'access_token'
        create_credentials_file: true
    - uses: google-github-actions/setup-gcloud@v1.0.1
    - run: gcloud auth configure-docker -q
    - uses: docker/login-action@v3
      with:
        username: mjgpluralsh
        password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
    - uses: docker/setup-qemu-action@v3
    - uses: docker/setup-buildx-action@v3.0.0
    - uses: docker/build-push-action@v5.1.0
      with:
        context: "./go"
        file: "./go/oci-auth/Dockerfile"
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        platforms: linux/amd64,linux/arm64
        cache-from: type=gha
        cache-to: type=gha,mode=max
        build-args: |
          GIT_COMMIT=${{ github.sha }}
          VERSION=${{ steps.meta.outputs.version }}