container.yml

name: Rosalind OCI image

on:
  release:
    types: [published]

permissions:
  contents: read
  packages: write
  id-token: write
  attestations: write

jobs:
  image:
    runs-on: ubuntu-latest
    environment: release
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - id: build
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        with:
          context: .
          file: containers/rosalind/Dockerfile
          platforms: linux/amd64
          push: true
          tags: ghcr.io/${{ github.repository }}:${{ github.event.release.tag_name || github.sha }}
          provenance: mode=max
          sbom: true
      - name: Offline non-root smoke
        run: |
          image="ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}"
          docker pull "$image"
          test "$(docker run --rm --network none --entrypoint id "$image" -u)" = 10001
          docker run --rm --network none "$image" --version
      - uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
        with:
          subject-name: ghcr.io/${{ github.repository }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true
      - name: Emit immutable lock candidate
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
          RELEASE: ${{ github.event.release.tag_name || github.sha }}
        run: |
          python3 - <<'PY'
          import json, os
          lock = json.load(open("integrations/container-lock.json"))
          lock.update(digest=os.environ["DIGEST"], release=os.environ["RELEASE"], status="published")
          open("container-lock.generated.json", "w").write(json.dumps(lock, indent=2, sort_keys=True) + "\n")
          PY
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: rosalind-container-lock
          path: container-lock.generated.json