1+ name : Docker
2+
3+ on :
4+ push :
5+ branches : [ "main" ]
6+
7+ env :
8+ REGISTRY : ghcr.io
9+ IMAGE_NAME : ${{ github.repository }}
10+
11+
12+ jobs :
13+ build :
14+ runs-on : ubuntu-latest
15+ permissions :
16+ contents : read
17+ packages : write
18+ # This is used to complete the identity challenge
19+ # with sigstore/fulcio when running outside of PRs.
20+ id-token : write
21+
22+ steps :
23+ - name : Checkout repository
24+ uses : actions/checkout@v5
25+ - name : Install cosign
26+ if : github.event_name != 'pull_request'
27+ uses : sigstore/cosign-installer@v3
28+ - name : Setup Docker buildx
29+ uses : docker/setup-buildx-action@v3
30+ - name : Log into registry ${{ env.REGISTRY }}
31+ if : github.event_name != 'pull_request'
32+ uses : docker/login-action@v3
33+ with :
34+ registry : ${{ env.REGISTRY }}
35+ username : ${{ github.actor }}
36+ password : ${{ secrets.GITHUB_TOKEN }}
37+ - name : Extract Docker metadata
38+ id : meta
39+ uses : docker/metadata-action@v5
40+ with :
41+ images : ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
42+ - run : ./amper package
43+ - name : Build and push Docker image
44+ id : build-and-push
45+ uses : docker/build-push-action@v6
46+ with :
47+ context : .
48+ push : ${{ github.event_name != 'pull_request' }}
49+ tags : ${{ steps.meta.outputs.tags }}
50+ labels : ${{ steps.meta.outputs.labels }}
51+ cache-from : type=gha
52+ cache-to : type=gha,mode=max
53+ - name : Sign the published Docker image
54+ if : ${{ github.event_name != 'pull_request' }}
55+ env :
56+ COSIGN_EXPERIMENTAL : " true"
57+ # This step uses the identity token to provision an ephemeral certificate
58+ # against the sigstore community Fulcio instance.
59+ run : echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign sign {}@${{ steps.build-and-push.outputs.digest }}
0 commit comments