release-docker-image.yml

name: release docker image

on:
  push:
    branches:
      - main
    tags:
      - "v*.*.*"
      - "v*.*.*-staging"

jobs:
  build:
    permissions:
      contents: read
      packages: write
      id-token: write # needed for signing the images with GitHub OIDC Token
    runs-on: ubuntu-latest
    name: build, release, sign
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          # list of Docker images to use as base name for tags
          images: |
            ghcr.io/metal-toolbox/ironlib
          # generate Docker tags based on the following events/attributes
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{raw}}
            type=sha

      - name: install cosign
        uses: sigstore/cosign-installer@main

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build and Push Images
        id: dockerbuild
        uses: docker/build-push-action@v5
        with:
          provenance: false
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          platforms: linux/amd64,linux/arm64

      - name: Scan image
        id: scan
        uses: anchore/scan-action@v3
        with:
          image: ghcr.io/metal-toolbox/ironlib@${{ steps.dockerbuild.outputs.digest }}
          acs-report-enable: true
          # TODO(jaosorior): Fail build once we migrate off CentOS.
          fail-build: false

      - name: Sign the images with GitHub OIDC Token
        run: cosign sign --recursive --yes ghcr.io/metal-toolbox/ironlib@${{ steps.dockerbuild.outputs.digest }}
        env:
          COSIGN_EXPERIMENTAL: true

      - uses: anchore/sbom-action/download-syft@v0.15.11

      # TODO(jaosorior): Uncomment once we migrate off CentOS.
      # - name: upload Anchore scan SARIF report
      #   uses: github/codeql-action/upload-sarif@v2
      #   with:
      #     sarif_file: ${{ steps.scan.outputs.sarif }}
      #   # This should run even if we fail the container scan
      #   if: always()

      - name: Inspect action SARIF report
        run: cat ${{ steps.scan.outputs.sarif }}
        # This should run even if we fail the container scan
        if: always()