Publish Image to Quay #75
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Image to Quay | |
| on: | |
| schedule: | |
| - cron: 0 0 */30 * * | |
| release: | |
| types: [ published ] | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: | | |
| Name of the tag for the published image. Will be published as <tag>-<branch>-<sha>. | |
| If a valid semver, associated semver tags will be published as well. | |
| type: string | |
| required: true | |
| skip_tests: | |
| description: "Skip end to end tests when publishing an image." | |
| type: boolean | |
| required: false | |
| default: false | |
| no_cache: | |
| description: "Skip using cache when building the image." | |
| type: boolean | |
| required: false | |
| default: false | |
| env: | |
| IMAGE_NAME: trestle-bot | |
| IMAGE_REGISTRY: quay.io | |
| concurrency: | |
| group: ${{ github.ref }}-${{ github.workflow }}-publish | |
| cancel-in-progress: true | |
| jobs: | |
| publish-image: | |
| runs-on: 'ubuntu-24.04' | |
| permissions: | |
| contents: read | |
| # kics-scan ignore-line | |
| id-token: write # needed for signing the images with GitHub OIDC Token | |
| steps: | |
| - name: Login to Quay | |
| uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # pin@v3 | |
| with: | |
| username: ${{ secrets.QUAY_USER }} | |
| password: ${{ secrets.QUAY_TOKEN }} | |
| registry: ${{ env.IMAGE_REGISTRY }} | |
| - name: Check out | |
| uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # pin@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Set up cosign | |
| uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # [email protected] | |
| - name: Check if triggered by release or workflow dispatch | |
| id: check_event | |
| run: echo "event_type=${{ toJson(github.event_name) }}" >> "$GITHUB_OUTPUT" | |
| # Using intermediary variable to process event based input | |
| - name: Set environment information for release | |
| if: ${{ steps.check_event.outputs.event_type == 'release' }} | |
| run: | | |
| { | |
| echo "TAG=$RELEASE_VERSION" | |
| echo "NO_CACHE=true" | |
| echo "BUILD_GIT_REF=$RELEASE_VERSION" | |
| echo "SKIP_TESTS=true" | |
| } >> "$GITHUB_ENV" | |
| env: | |
| RELEASE_VERSION: ${{ github.event.release.tag_name }} | |
| - name: Set environment information for workflow dispatch | |
| if: ${{ steps.check_event.outputs.event_type == 'workflow_dispatch' }} | |
| run: | | |
| { | |
| echo "TAG=$INPUT_VERSION" | |
| echo "NO_CACHE=$INPUT_NO_CACHE" | |
| echo "BUILD_GIT_REF=${{ github.ref }}" | |
| echo "SKIP_TESTS=$INPUT_SKIP_TESTS" | |
| } >> "$GITHUB_ENV" | |
| env: | |
| INPUT_VERSION: ${{ github.event.inputs.tag }} | |
| INPUT_NO_CACHE: ${{ github.event.inputs.no_cache }} | |
| INPUT_SKIP_TESTS: ${{ github.event.inputs.skip_tests }} | |
| - name: Set environment information for schedule | |
| if: ${{ steps.check_event.outputs.event_type == 'schedule' }} | |
| run: | | |
| LATEST_VERSION=$( gh release view --json tagName --jq '.["tagName"]' ) | |
| { | |
| echo "TAG=$LATEST_VERSION" | |
| echo "NO_CACHE=true" | |
| echo "BUILD_GIT_REF=$LATEST_VERSION" | |
| echo "SKIP_TESTS=false" | |
| } >> "$GITHUB_ENV" | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and Publish the image | |
| uses: ./.github/actions/publish-image | |
| id: build_publish_image | |
| with: | |
| image: ${{ env.IMAGE_REGISTRY }}/${{ vars.QUAY_ORG }}/${{ env.IMAGE_NAME }} | |
| release_version: ${{ env.TAG }} | |
| no_cache: ${{ env.NO_CACHE }} | |
| git_ref: ${{ env.BUILD_GIT_REF }} | |
| skip_tests: ${{ env.SKIP_TESTS }} | |
| - name: Sign the image with GitHub OIDC Token | |
| run: cosign sign --yes "$IMAGE" | |
| env: | |
| IMAGE: ${{ steps.build_publish_image.outputs.image_sha }} | |
| - name: Verify image | |
| run: | | |
| cosign verify "$IMAGE" --certificate-identity-regexp="$SUBJECT" \ | |
| --certificate-oidc-issuer=https://token.actions.githubusercontent.com | |
| env: | |
| SUBJECT: https://github\.com/${{ github.repository_owner }}/trestle-bot/\.github/.+ | |
| IMAGE: ${{ steps.build_publish_image.outputs.image_sha }} |