This repository was archived by the owner on Mar 24, 2025. It is now read-only.

Merge pull request #2 from step-security-bot/stepsecurity_remediation… #66

	name: Build action

	on:
	push:
	schedule:
	- cron: '15 3 * * *' # every day at 03:15 (just wanted to avoid midnight)

	jobs:
	build:
	name: Build nginx image
	runs-on: ubuntu-latest

	# https://docs.github.com/en/actions/reference/authentication-in-a-workflow
	permissions:
	id-token: write
	packages: write
	contents: read

	steps:
	- name: Generate snapshot date
	id: snapshot-date
	run: \|
	echo ::set-output name=date::$(date -u +%Y%m%d)
	echo ::set-output name=epoch::$(date -u +%s)
	shell: bash

	- uses: actions/checkout@85e6279cec87321a52edac9c87bce653a07cf6c2 # main
	- uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # main

	- uses: chainguard-dev/actions/apko-build@main
	id: apko
	with:
	config: nginx.yaml
	tag: ghcr.io/${{ github.repository }}:latest
	archs: x86_64
	source-date-epoch: ${{ steps.snapshot-date.outputs.epoch }}

	- uses: docker/login-action@bb984efc561711aaa26e433c32c3521176eae55b # v1.13.0
	with:
	registry: ghcr.io
	username: ${{ github.repository_owner }}
	password: ${{ github.token }}

	- shell: bash
	run: \|
	# TODO: Add attributes based on things like the commit.
	COSIGN_EXPERIMENTAL=true cosign sign ${{ steps.apko.outputs.digest }}

Provide feedback