rust-finance/.github/workflows/docker-build.yml at main · Ashutosh0x/rust-finance · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
# .github/workflows/docker-build.yml
# Builds multi-arch Docker images and pushes to GitHub Container Registry (ghcr.io)
# Triggered on release tags AND manual dispatch for ad-hoc builds.

name: "Docker Build & Push"

on:
  push:
    tags: ["v*"]
  workflow_dispatch:
    inputs:
      tag_override:
        description: "Image tag override (default: git ref)"
        required: false
        type: string

permissions: {}

env:
  REGISTRY: ghcr.io
  # OCI image references must be lowercase. Keep this explicit so signing and
  # attestations use the same canonical GHCR name as docker/metadata-action.
  IMAGE_NAME: ashutosh0x/rust-finance

jobs:
  # ── Build & push multi-arch Docker image ──────────────────────
  docker:
    name: "Build & Push (${{ matrix.platform }})"
    runs-on: ${{ matrix.runner }}
    permissions:
      contents: read
      packages: write
      id-token: write       # Sigstore keyless signing
      attestations: write   # GitHub Attestations
    strategy:
      fail-fast: false
      matrix:
        include:
          - platform: linux/amd64
            runner: ubuntu-latest
          - platform: linux/arm64
            runner: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      # Expose platform as env for tagging
      - name: Sanitize platform for tag
        id: platform
        shell: bash
        run: echo "pair=$(echo '${{ matrix.platform }}' | tr '/' '-')" >> "$GITHUB_OUTPUT"

      # Docker Buildx for multi-platform support
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0

      # QEMU for cross-platform emulation (arm64 on amd64 runners)
      - name: Set up QEMU
        uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
        if: matrix.platform == 'linux/arm64'

      # Authenticate to GitHub Container Registry
      - name: Log in to GHCR
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Extract metadata (tags, labels) for Docker
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=sha,prefix=sha-
            type=raw,value=${{ inputs.tag_override }},enable=${{ inputs.tag_override != '' }}
            type=raw,value=latest,enable={{is_default_branch}}

      # Build and push per-platform image
      - name: Build and push by digest
        id: build
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .
          platforms: ${{ matrix.platform }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: true
          sbom: true
          build-args: |
            BUILDKIT_INLINE_CACHE=1

      # Sigstore keyless signing of the image
      - name: Install cosign
        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0

      - name: Sign container image (Sigstore keyless)
        shell: bash
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
        run: |
          IMAGES="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
          cosign sign --yes "${IMAGES}@${DIGEST}"

      # GitHub provenance attestation
      - name: Attest build provenance
        uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v2.1.0
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true

      # Output digest for downstream verification
      - name: Export digest
        shell: bash
        run: |
          echo "## Docker Image Published" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "| Field | Value |" >> "$GITHUB_STEP_SUMMARY"
          echo "|-------|-------|" >> "$GITHUB_STEP_SUMMARY"
          echo "| **Registry** | \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}\` |" >> "$GITHUB_STEP_SUMMARY"
          echo "| **Platform** | \`${{ matrix.platform }}\` |" >> "$GITHUB_STEP_SUMMARY"
          echo "| **Digest** | \`${{ steps.build.outputs.digest }}\` |" >> "$GITHUB_STEP_SUMMARY"
          echo "| **Signed** | Sigstore keyless |" >> "$GITHUB_STEP_SUMMARY"