1  name: Docker Publish
 2  
 3  on:
 4    push:
 5      branches: [ "main" ]
 6      tags: [ 'v*.*.*' ]
 7  
 8  env:
 9    REGISTRY: ghcr.io
10    IMAGE_NAME: ${{ github.repository }}
11  
12  
13  jobs:
14    build:
15      runs-on: ubuntu-latest
16      permissions:
17        contents: read
18        packages: write
19        id-token: write
20  
21      steps:
22        - name: Checkout repository
23          uses: actions/checkout@v3
24        - name: Install cosign
25          if: github.event_name != 'pull_request'
26          uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1
27          with:
28            cosign-release: 'v2.1.1'
29  
30        - name: Set up Docker Buildx
31          uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
32  
33        - name: Log into registry ${{ env.REGISTRY }}
34          if: github.event_name != 'pull_request'
35          uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
36          with:
37            registry: ${{ env.REGISTRY }}
38            username: ${{ github.actor }}
39            password: ${{ secrets.GITHUB_TOKEN }}
40  
41        - name: Extract Docker metadata
42          id: meta
43          uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
44          with:
45            images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
46  
47        - name: Build and push Docker image
48          id: build-and-push
49          uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
50          with:
51            context: .
52            push: ${{ github.event_name != 'pull_request' }}
53            tags: ${{ steps.meta.outputs.tags }}
54            labels: ${{ steps.meta.outputs.labels }}
55            cache-from: type=gha
56            cache-to: type=gha,mode=max
57  
58        - name: Sign the published Docker image
59          if: ${{ github.event_name != 'pull_request' }}
60          env:
61            TAGS: ${{ steps.meta.outputs.tags }}
62            DIGEST: ${{ steps.build-and-push.outputs.digest }}
63          run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}