container-build.yml

name: Build container image and sign it

on:
  push:
    branches:
      - "main"
      - "feat-**"

permissions:
  contents: read

jobs:
  build:
    name: Build container image
    permissions:
      packages: write
      id-token: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Install cosign
        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0

      - name: Set up QEMU
        uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a # v3.3.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Retrieve tag name (main branch)
        if: ${{ startsWith(github.ref, 'refs/heads/main') }}
        run: |
          echo TAG_NAME=latest >> $GITHUB_ENV

      - name: Retrieve tag name (feat branch)
        if: ${{ startsWith(github.ref, 'refs/heads/feat') }}
        run: |
          echo "TAG_NAME=latest-$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_ENV

      - name: Push and push container image
        id: build-image
        uses: docker/build-push-action@67a2d409c0a876cbe6b11854e3e25193efe4e62d # v6.12.0
        with:
          context: .
          file: ./Dockerfile
          platforms: linux/amd64, linux/arm64
          push: true
          sbom: false # SBOM for feature and main branches is not generated
          provenance: false # Provenance for feature and main branches is not generated
          tags: |
            ghcr.io/${{github.repository_owner}}/policy-server:${{ env.TAG_NAME }}

      - name: Sign container image
        run: |
          cosign sign --yes ghcr.io/${{github.repository_owner}}/policy-server@${{ steps.build-image.outputs.digest }}
            
          cosign verify \
            --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
            --certificate-identity="https://github.com/${{github.repository_owner}}/policy-server/.github/workflows/container-build.yml@${{ github.ref }}" \
            ghcr.io/${{github.repository_owner}}/policy-server@${{ steps.build-image.outputs.digest }}