nightly.yml

name: nightly
on:
  workflow_dispatch:
  schedule:
  - cron: "0 10 * * *"
permissions:
  contents: read
  packages: write
  id-token: write
jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        component:
        - xen
        - oxenstored
        - qemu-xen
    name: oci build ${{ matrix.component }}
    steps:
    - uses: step-security/harden-runner@c95a14d0e5bab51a9f56296a4eb0e416910cd350 # v2.10.3
      with:
        egress-policy: audit
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        submodules: recursive
    - uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
    - uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a # v3.3.0
    - uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
    - uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - uses: docker/build-push-action@b32b51a8eda65d6793cd0494a773d4f6bcef32dc # v6.11.0
      id: push-step
      with:
        file: ./Dockerfile.${{ matrix.component }}
        platforms: linux/amd64,linux/aarch64
        tags: ghcr.io/edera-dev/${{ matrix.component }}:nightly
        push: true
    - name: Sign the image
      env:
        DIGEST: ${{ steps.push-step.outputs.digest }}
        TAGS: ghcr.io/edera-dev/${{ matrix.component }}:nightly
        COSIGN_EXPERIMENTAL: "true"
      run: cosign sign --yes "${TAGS}@${DIGEST}"