publish.yml

name: Create and publish a Docker image

on:
  push:
    branches:
      - main
      - dev
  workflow_dispatch:

env:
  REGISTRY: ghcr.io
  REPO_NAME: ${{ github.repository }}

jobs:
  build-and-push-image:
    runs-on: ubuntu-latest
    # Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
    permissions:
      contents: read
      packages: write
      attestations: write
      id-token: write
      #
    strategy:
      matrix:
        image:
          - tofutf
          - rig-ubuntu
          - rig-rocky8
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract metadata (tags, labels) for Docker
        env:
          IMAGE: ${{ matrix.image }}.Dockerfile
        id: meta
        run: |
          echo "tag=$(grep FROM $IMAGE | cut -d: -f2)" >> "$GITHUB_OUTPUT"
      # setup buildx is needed to use cache
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Build and push Docker image
        id: push
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ${{ matrix.image }}.Dockerfile
          push: ${{ github.ref == 'refs/heads/main' }}
          tags: |
            ${{ env.REGISTRY }}/${{ env.REPO_NAME }}/${{ matrix.image }}:${{ steps.meta.outputs.tag }}
            ${{ env.REGISTRY }}/${{ env.REPO_NAME }}/${{ matrix.image }}:latest
          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.REPO_NAME }}/${{ matrix.image }}:latest
          cache-to: type=inline

      # # This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see "[AUTOTITLE](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds)."
      # - name: Generate artifact attestation
      #   uses: actions/attest-build-provenance@v1
      #   with:
      #     subject-name: ${{ env.REGISTRY }}/${{ env.REPO_NAME }}/${{ matrix.image }}
      #     subject-digest: ${{ steps.push.outputs.digest }}
      #     push-to-registry: true