push-main.yaml

name: image

on:
  push:
    branches:
      - main
      - release-1.15

permissions:
  id-token: write
  packages: write
  security-events: write

jobs:
  ko:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: backend/go.mod
          cache-dependency-path: backend/go.sum
      - name: Login
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Install Cosign
        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
      - name: Build assets
        run: |
          set -e
          make build-backend-assets
      - name: Publish image
        id: ko-publish
        run: |
          set -e
          echo "digest=$(VERSION=${{ github.ref_name }} make ko-publish)" >> $GITHUB_OUTPUT
      - name: Sign image
        run: |
          set -e
          cosign sign ${{ steps.ko-publish.outputs.digest }} --yes