Publish Image to Quay #22
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Image to Quay | |
| on: | |
| release: | |
| types: [published] | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: "Name of the tag for the published image" | |
| type: string | |
| required: true | |
| skip_tests: | |
| description: "Skip end to end tests when publishing an image." | |
| type: boolean | |
| required: false | |
| default: false | |
| no_cache: | |
| description: "Skip using cache when building the image." | |
| type: boolean | |
| required: false | |
| default: false | |
| env: | |
| IMAGE_NAME: trestle-bot | |
| IMAGE_REGISTRY: quay.io | |
| jobs: | |
| publish-image: | |
| runs-on: 'ubuntu-latest' | |
| permissions: | |
| contents: read | |
| # kics-scan ignore-line | |
| id-token: write # needed for signing the images with GitHub OIDC Token | |
| outputs: | |
| skip_tests: ${{ steps.check_event.outputs.event_type == 'release' || | |
| (steps.check_event.outputs.event_type == 'workflow_dispatch' && | |
| github.event.inputs.skip_tests == 'true') }} | |
| image: ${{ steps.set_image_repo.outputs.image_repo }}@${{ steps.build-and-push.outputs.digest }} | |
| steps: | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Set up cosign | |
| uses: sigstore/[email protected] | |
| - name: Login to Quay | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.QUAY_USER }} | |
| password: ${{ secrets.QUAY_TOKEN }} | |
| registry: ${{ env.IMAGE_REGISTRY }} | |
| - name: Set image repository | |
| id: set_image_repo | |
| run: | | |
| echo "image_repo=${{ env.IMAGE_REGISTRY }}/${{ vars.QUAY_ORG }}/${{ env.IMAGE_NAME }}" >> "$GITHUB_OUTPUT" | |
| - name: Check if triggered by release or workflow dispatch | |
| id: check_event | |
| run: echo "event_type=${{ toJson(github.event_name) }}" >> "$GITHUB_OUTPUT" | |
| # Using intermediary variable to process event based input | |
| - name: Set TAG environment variable for Release | |
| if: ${{ steps.check_event.outputs.event_type == 'release' }} | |
| run: | | |
| echo "TAG=$RELEASE_VERSION" >> "$GITHUB_ENV" | |
| echo "NO_CACHE=true" >> "$GITHUB_ENV" | |
| env: | |
| RELEASE_VERSION: ${{ github.event.release.tag_name }} | |
| - name: Set TAG environment variable for Workflow Dispatch | |
| if: ${{ steps.check_event.outputs.event_type == 'workflow_dispatch' }} | |
| run: | | |
| echo "TAG=$INPUT_VERSION" >> "$GITHUB_ENV" | |
| echo "NO_CACHE=$INPUT_NO_CACHE" >> "$GITHUB_ENV" | |
| env: | |
| INPUT_VERSION: ${{ github.event.inputs.tag }} | |
| INPUT_NO_CACHE: ${{ github.event.inputs.no_cache }} | |
| - name: Build and export to Docker | |
| uses: docker/build-push-action@v5 | |
| id: build-and-export | |
| with: | |
| load: true | |
| no-cache: ${{ env.NO_CACHE == 'true' }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| tags: ${{ steps.set_image_repo.outputs.image_repo }}:${{ env.TAG }} | |
| - name: Pre-push Image Scan | |
| uses: aquasecurity/[email protected] | |
| with: | |
| image-ref: ${{ steps.set_image_repo.outputs.image_repo }}:${{ env.TAG }} | |
| exit-code: 1 | |
| skip-files: "**/.venv/lib/**/METADATA" | |
| scanners: secret | |
| severity: HIGH,CRITICAL,MEDIUM | |
| # Does not rebuild. Uses internal cache from previous step. | |
| - name: Build and Push | |
| uses: docker/build-push-action@v5 | |
| id: build-and-push | |
| with: | |
| push: true | |
| tags: ${{ steps.set_image_repo.outputs.image_repo }}:${{ env.TAG }} | |
| - name: Sign the image with GitHub OIDC Token | |
| run: cosign sign --yes "$IMAGE@$DIGEST" | |
| env: | |
| DIGEST: ${{ steps.build-and-push.outputs.digest }} | |
| IMAGE: ${{ steps.set_image_repo.outputs.image_repo }} | |
| - name: Verify image | |
| run: | | |
| cosign verify "$IMAGE@$DIGEST" --certificate-identity-regexp="$SUBJECT" \ | |
| --certificate-oidc-issuer=https://token.actions.githubusercontent.com | |
| env: | |
| SUBJECT: https://github\.com/${{ github.repository_owner }}/trestle-bot/\.github/.+ | |
| IMAGE: ${{ steps.set_image_repo.outputs.image_repo }} | |
| DIGEST: ${{ steps.build-and-push.outputs.digest }} | |
| test: | |
| permissions: | |
| contents: read | |
| needs: publish-image | |
| if: ${{ needs.publish-image.outputs.skip_tests != 'true' }} | |
| uses: ./.github/workflows/e2e.yml | |
| with: | |
| image: ${{ needs.publish-image.outputs.image }} |