publish-container-image.yaml

name: Publish Container Image

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{github.repository}}

on:
  push:
    branches: ["main"]
    tags: ['v*.*.*']

jobs:
  publish-docker-image:
    name: Publish Docker Image to GitHub Package
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
    - name: Checkout
      uses: actions/checkout@v4
    - name: Install cosign
      if: github.event_name != 'pull_request'
      uses: sigstore/cosign-installer@v3
    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
    - name: Log into registry ${{env.REGISTRY}}
      if: github.event_name != 'pull_request'
      uses: docker/login-action@v3
      with:
        registry: ${{env.REGISTRY}}
        username: ${{github.actor}}
        password: ${{secrets.GITHUB_TOKEN}}
    - name: Extract Docker metadata
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ${{env.REGISTRY}}/${{env.IMAGE_NAME}}
    - name: Build and push Docker image
      id: build-and-push
      uses: docker/build-push-action@v6
      with:
        platforms: linux/amd64,linux/arm64
        push: ${{github.event_name != 'pull_request'}}
        tags: ${{steps.meta.outputs.tags}}
        labels: ${{steps.meta.outputs.labels}}
        cache-from: type=gha
        cache-to: type=gha,mode=max
    - name: Sign the published Docker image
      if: ${{github.event_name != 'pull_request'}}
      env:
        TAGS: ${{steps.meta.outputs.tags}}
        DIGEST: ${{steps.build-and-push.outputs.digest}}
      run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}