publish.yml

name: Publish Image to Quay

on:
  schedule:
    - cron: 0 0 */30 * *
  release:
    types: [ published ]
  workflow_dispatch:
    inputs:
      tag:
        description: |
          Name of the tag for the published image. Will be published as <tag>-<branch>-<sha>.
          If a valid semver, associated semver tags will be published as well.
        type: string
        required: true
      skip_tests:
        description: "Skip end to end tests when publishing an image."
        type: boolean
        required: false
        default: false
      no_cache:
        description: "Skip using cache when building the image."
        type: boolean
        required: false
        default: false
env:
  IMAGE_NAME: trestle-bot
  IMAGE_REGISTRY: quay.io

concurrency:
  group: ${{ github.ref }}-${{ github.workflow }}-publish
  cancel-in-progress: true

jobs:
  publish-image:
    runs-on: 'ubuntu-24.04'
    permissions:
      contents: read
      # kics-scan ignore-line
      id-token: write # needed for signing the images with GitHub OIDC Token
    steps:
      - name: Login to Quay
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # pin@v3
        with:
          username: ${{ secrets.QUAY_USER }}
          password: ${{ secrets.QUAY_TOKEN }}
          registry: ${{ env.IMAGE_REGISTRY }}

      - name: Set up cosign
        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # pin@v3.5.0

      - name: Check if triggered by release or workflow dispatch
        id: check_event
        run: echo "event_type=${{ toJson(github.event_name) }}" >> "$GITHUB_OUTPUT"

      # Using intermediary variable to process event based input
      - name: Set environment information for release
        if: ${{ steps.check_event.outputs.event_type == 'release' }}
        run: |
          {
            echo "TAG=$RELEASE_VERSION"
            echo "NO_CACHE=true"
            echo "BUILD_GIT_REF=$RELEASE_VERSION"
            echo "SKIP_TESTS=true"
          } >> "$GITHUB_ENV"
        env:
          RELEASE_VERSION: ${{ github.event.release.tag_name }}

      - name: Set environment information for workflow dispatch
        if: ${{ steps.check_event.outputs.event_type == 'workflow_dispatch' }}
        run: |
          {
            echo "TAG=$INPUT_VERSION" 
            echo "NO_CACHE=$INPUT_NO_CACHE"
            echo "BUILD_GIT_REF=${{ github.ref }}"
            echo "SKIP_TESTS=$INPUT_SKIP_TESTS"
          } >> "$GITHUB_ENV"
        env:
          INPUT_VERSION: ${{ github.event.inputs.tag }}
          INPUT_NO_CACHE: ${{ github.event.inputs.no_cache }}
          INPUT_SKIP_TESTS: ${{ github.event.inputs.skip_tests }}

      - name: Set environment information for schedule
        if: ${{ steps.check_event.outputs.event_type == 'schedule' }}
        run: |
          LATEST_VERSION=$( gh release view --json tagName --jq '.["tagName"]' )      
          {
            echo "TAG=$LATEST_VERSION"
            echo "NO_CACHE=true"
            echo "BUILD_GIT_REF=$LATEST_VERSION"
            echo "SKIP_TESTS=false"
          } >> "$GITHUB_ENV"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      
      - name: Check out
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # pin@v4
        with:
          ref: ${{ env.BUILD_GIT_REF }}
          persist-credentials: false

      - name: Build and Publish the image
        uses: ./.github/actions/publish-image
        id: build_publish_image
        with:
          image: ${{ env.IMAGE_REGISTRY }}/${{ vars.QUAY_ORG }}/${{ env.IMAGE_NAME }}
          release_version: ${{ env.TAG }}
          no_cache: ${{ env.NO_CACHE }}
          skip_tests: ${{ env.SKIP_TESTS }}

      - name: Sign the image with GitHub OIDC Token
        run: cosign sign --yes "$IMAGE"
        env:
          IMAGE: ${{ steps.build_publish_image.outputs.image_sha }}

      - name: Verify image
        run: |
          cosign verify "$IMAGE" --certificate-identity-regexp="$SUBJECT" \
          --certificate-oidc-issuer=https://token.actions.githubusercontent.com
        env:
          SUBJECT: https://github\.com/${{ github.repository_owner }}/trestle-bot/\.github/.+
          IMAGE: ${{ steps.build_publish_image.outputs.image_sha }}