release-image.yaml

name: Docker Image Release

on:
  push:
    tags:
      - 'v*.*.*'

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      packages: write
      id-token: write
      contents: read
      actions: read
      security-events: write
    env:
      REGISTRY: ghcr.io
      IMAGE: ${{ github.repository }}

    steps:
      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2

      - uses: docker/setup-buildx-action@v1
        name: Set up Docker Buildx

      - name: Login to registry
        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value={{sha}},enable=${{ github.ref_type != 'tag' }}

      - name: Build and push
        uses: docker/build-push-action@v4
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ env.REGISTRY }}/${{ github.repository }}:${{ github.run_id }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            GITHUB_TOKEN=${{ secrets.TOKEN }}

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3.1.1

      - name: Sign the images
        run: |
          cosign sign -y ${{ env.REGISTRY }}/${{ github.repository }}:${{ github.run_id }}

        env:
          COSIGN_EXPERIMENTAL: 1

      - name: Verify the pushed tags
        run: |
          cosign verify ${{ steps.meta.outputs.tags }} --certificate-identity ${{ env.GH_URL }}/${{ github.repository }}/.github/workflows/release-image.yaml@refs/tags/${{ github.ref }} --certificate-oidc-issuer https://token.actions.githubusercontent.com

        env:
          COSIGN_EXPERIMENTAL: 1