docker.yaml

name: Publish Docker Image

on:
  push:
    tags:    
      - '**'

permissions: read-all

jobs:
  push_to_registry:
    name: Push Docker Image to Docker Hub
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 # v2.0.0
        with:
          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

      - name: Install Cosign
        uses: sigstore/cosign-installer@55fd288876ce156f3d39276ebf89f86bf3702f37 # main

      - name: Extract branch name
        shell: bash
        run: echo "##[set-output name=branch;]$(echo ${GITHUB_REF#refs/heads/})"
        id: extract_branch

      - name: Check out the repo
        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
      
      - name: Log in to Docker Hub
        uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      
      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@57396166ad8aefe6098280995947635806a0e6ea # v4.1.1
        with:
          images: chr1st1anh/lnd
          tags: type=sha,format=long
      
      - name: Build and push Docker image
        uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
        with:
          context: ./docker
          push: true
          tags: chr1st1anh/lnd:${{ github.ref_name }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: |
            checkout=${{ github.ref_name }}

      - name: Sign image with a key
        run: |
          cosign sign --key env://COSIGN_PRIVATE_KEY ${TAGS}
        env:
          TAGS: chr1st1anh/lnd:${{ github.ref_name }}
          COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
          COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}