container-build-push.yaml

---
name: Container Build and Push

on:
  push:
    branches:
      - main
    tags:
      - v*
  pull_request:

defaults:
  run:
    shell: bash

permissions:
  contents: read
  packages: write
  # This is used to complete the identity challenge with sigstore/fulcio.
  id-token: write

env:
  # Use docker.io for Docker Hub if empty
  REGISTRY: ghcr.io
  # github.repository as <account>/<repo>
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build-push:
    strategy:
      fail-fast: false
      matrix:
        platform:
          - linux/amd64

    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7

      - name: Install cosign
        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20  # v3.5.0

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db  # v3.6.1
        with:
          platforms: ${{ matrix.platform }}

      - name: Log in to container registry (${{ env.REGISTRY }})
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567  # v3.3.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: docker_meta
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81  # v5.5.1
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=edge
            # FIXME: Remove explicit `latest` tag once we start tagging releases
            type=raw,value=latest,enable={{is_default_branch}}
            type=ref,event=tag
            type=sha,format=long

      - name: Build and push Docker image
        id: docker_build_push
        uses: docker/build-push-action@5176d81f87c23d6fc96624dfdbcd9f3830bbe445  # v6.5.0
        with:
          builder: ${{ steps.buildx.outputs.name }}
          build-args: |
            git_sha=${{ github.sha }}
          cache-from: type=gha,scope=${{ matrix.platform }}
          cache-to: type=gha,mode=max,scope=${{ matrix.platform }}
          labels: ${{ steps.docker_meta.outputs.labels }}
          platforms: ${{ matrix.platform }}
          push: ${{ github.ref == 'refs/heads/main' || startswith(github.event.ref, 'refs/tags/v') }}
          tags: ${{ steps.docker_meta.outputs.tags }}

      # Sign the resulting Docker image digest.
      # This will only write to the public Rekor transparency log when the Docker repository is public to avoid leaking
      # data. If you would like to publish transparency data even for private images, pass --force to cosign below.
      # https://github.com/sigstore/cosign
      - name: Sign the published Docker image
        if: ${{ github.ref == 'refs/heads/main' || startswith(github.event.ref, 'refs/tags/v') }}
        # This step uses the identity token to provision an ephemeral certificate against the sigstore community Fulcio
        # instance.
        run: cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.docker_build_push.outputs.digest }}

      - name: Export digest
        if: ${{ github.ref == 'refs/heads/main' || startswith(github.event.ref, 'refs/tags/v') }}
        run: |
          mkdir -p /tmp/digests
          digest='${{ steps.docker_build_push.outputs.digest }}'
          touch "/tmp/digests/${digest#sha256:}"

      - name: Upload digest
        if: ${{ github.ref == 'refs/heads/main' || startswith(github.event.ref, 'refs/tags/v') }}
        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b  # v4.3.4
        with:
          if-no-files-found: error
          name: digests
          path: /tmp/digests/*
          retention-days: 1

  merge:
    if: ${{ github.ref == 'refs/heads/main' || startswith(github.event.ref, 'refs/tags/v') }}
    needs:
      - build-push

    runs-on: ubuntu-24.04
    steps:
      - name: Download digests
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16  # v4.1.8
        with:
          name: digests
          path: /tmp/digests

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db  # v3.6.1

      - name: Log in to container registry (${{ env.REGISTRY }})
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567  # v3.3.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: docker_meta
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81  # v5.5.1
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=edge
            # FIXME: Remove explicit `latest` tag once we start tagging releases
            type=raw,value=latest,enable={{is_default_branch}}
            type=ref,event=tag
            type=sha,format=long

      - name: Create manifest list and push
        working-directory: /tmp/digests
        run: >
          docker buildx imagetools create \
            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "${DOCKER_METADATA_OUTPUT_JSON}") \
            $(printf ' ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)

      - name: Inspect image
        run: >-
          docker buildx imagetools inspect \
            '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.docker_meta.outputs.version }}'