go-bot
1name: Docker2
3# This workflow uses actions that are not certified by GitHub.
4# They are provided by a third-party and are governed by
5# separate terms of service, privacy policy, and support
6# documentation.
7
8on:9workflow_dispatch:10
11env:12# Use docker.io for Docker Hub if empty13REGISTRY: docker.io14# github.repository as <account>/<repo>15IMAGE_NAME: ${{ secrets.IMAGE_NAME }}16
17
18jobs:19build:20
21runs-on: ubuntu-latest22permissions:23contents: read24packages: write25# This is used to complete the identity challenge26# with sigstore/fulcio when running outside of PRs.27id-token: write28
29steps:30- name: Checkout repository31uses: actions/checkout@v232
33# Install the cosign tool except on PR34# https://github.com/sigstore/cosign-installer35- name: Install cosign36if: github.event_name != 'pull_request'37uses: sigstore/cosign-installer@1e95c1de343b5b0c23352d6417ee3e48d5bcd42238with:39cosign-release: 'v1.4.0'40
41
42# Workaround: https://github.com/docker/build-push-action/issues/46143- name: Setup Docker buildx44uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf45
46# Login against a Docker registry except on PR47# https://github.com/docker/login-action48- name: Log into registry ${{ env.REGISTRY }}49if: github.event_name != 'pull_request'50uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c51with:52registry: ${{ env.REGISTRY }}53username: ${{ secrets.DOCKER_HUB_USERNAME }}54password: ${{ secrets.DOCKER_HUB_TOKEN }}55
56# Extract metadata (tags, labels) for Docker57# https://github.com/docker/metadata-action58- name: Extract Docker metadata59id: meta60uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c3861with:62images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}63
64# Build and push Docker image with Buildx (don't push on PR)65# https://github.com/docker/build-push-action66- name: Build and push Docker image67id: build-and-push68uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc69with:70context: .71push: ${{ github.event_name != 'pull_request' }}72tags: ${{ steps.meta.outputs.tags }}73labels: ${{ steps.meta.outputs.labels }}74
75# Sign the resulting Docker image digest except on PRs.76# This will only write to the public Rekor transparency log when the Docker77# repository is public to avoid leaking data. If you would like to publish78# transparency data even for private images, pass --force to cosign below.79# https://github.com/sigstore/cosign80- name: Sign the published Docker image81if: ${{ github.event_name != 'pull_request' }}82env:83COSIGN_EXPERIMENTAL: "true"84# This step uses the identity token to provision an ephemeral certificate85# against the sigstore community Fulcio instance.86run: cosign sign ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }}87