release.yaml

name: release

on:
  workflow_dispatch:

env:
  TAG: ${{ github.ref_name }}
  REGISTRY: ghcr.io
  USERNAME: ${{ github.actor }}
  PASSWORD: ${{ secrets.GITHUB_TOKEN }}
  ORG: alexander-demicev
  PROD_ORG: alexander-demicev
  CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
  GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
  RELEASE_DIR: .cr-release-packages
  REPO: ${{ github.repository }}

permissions:
  contents: write # Allow to create a release.

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      multiarch_image: ${{ steps.ghcr-images.outputs.multiarch }}
      amd64_image: ${{ steps.ghcr-images.outputs.amd64 }}
      armd64_image: ${{ steps.ghcr-images.outputs.arm64 }}
      s390x_image: ${{ steps.ghcr-images.outputs.s390x }}
      multiarch_digest: ${{ steps.ghcr-images.outputs.multiarch_digest }}
      arm64_digest: ${{ steps.ghcr-images.outputs.arm64_digest }}
      amd64_digest: ${{ steps.ghcr-images.outputs.amd64_digest }}
      s390x_digest: ${{ steps.ghcr-images.outputs.s390x_digest }}
    steps:
    - name: Checkout
      uses: actions/checkout@v4
      with:
        fetch-depth: 0
    - name: setupGo
      uses: actions/setup-go@v4
      with:
        go-version: '=1.20.7'
    - name: Docker login to ghcr registry
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ env.USERNAME }}
        password: ${{ env.PASSWORD }}
    - name: Build docker image for gh registry
      run: make docker-build-all TAG=${{ env.TAG }} REGISTRY=${{ env.REGISTRY }}
    - name: Push docker image to gh registry
      run: make docker-push-all TAG=${{ env.TAG }} REGISTRY=${{ env.REGISTRY }}
    - name: Store list of ghcr images
      id: ghcr-images
      run: |
        ./scripts/image-digest.sh ${{ env.REGISTRY }} ${{ env.PROD_ORG }} ${{ env.TAG }}
  ghcr-sign:
    runs-on: ubuntu-latest
    needs: [build]
    strategy:
      matrix:
        images: [
          {
              "image":"${{ needs.build.outputs.multiarch_image }}",
          },
          {
              "image":"${{ needs.build.outputs.amd64_image }}",
          },
          {
              "image":"${{ needs.build.outputs.amd64_image }}",
          },
          {
              "image":"${{ needs.build.outputs.s390x_image }}",
          }
        ]
    steps:
      - uses: sigstore/cosign-installer@v3.1.2
      - name: Sign manifests
        env:
          COSIGN_EXPERIMENTAL: 1
        run: |
          echo ${{ matrix.images }}
          echo ${{ matrix.images.image }}
          cosign sign --yes ${{ matrix.images.image }}
  ghcr-provenance:
    needs: [build, ghcr-sign]
    permissions:
      actions: read 
      id-token: write
      packages: write
    strategy:
      matrix:
        images: [
          {
              "image":"${{ needs.build.outputs.multiarch_image }}",
              "digest":"${{ needs.build.outputs.multiarch_digest }}"
          },
          {
              "image":"${{ needs.build.outputs.amd64_image }}",
              "digest":"${{ needs.build.outputs.amd64_digest }}"
          },
          {
              "image":"${{ needs.build.outputs.amd64_image }}",
              "digest":"${{ needs.build.outputs.arm64_digest }}"
          },
          {
              "image":"${{ needs.build.outputs.s390x_image }}",
              "digest":"${{ needs.build.outputs.s390x_digest }}"
          }
        ]
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.9.0
    with:
      image: ${{ matrix.images.image }}
      digest: ${{ matrix.images.digest }}
    secrets:
      registry-username: ${{ github.actor }}
      registry-password: ${{ secrets.GITHUB_TOKEN }}