build.yaml

name: build
on:
  push:
    branches:
    - '*'
    tags:
    - '*'
  pull_request:
jobs:
  build:
    permissions:
      id-token: write
      contents: read
    env:
      IMAGE: quay.io/evryfs/opensearch-docker
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v4
    - uses: brpaz/hadolint-action@v1.5.0
    - name: Docker meta
      id: meta
      uses: docker/metadata-action@v5
      with:
        # list of Docker images to use as base name for tags
        images: |
          ${{ env.IMAGE }}
        # generate Docker tags based on the following events/attributes
        tags: |
          type=ref,event=tag
        flavor: |
          latest=false
    - name: Login to quay.io
      if: startsWith(github.ref, 'refs/tags/')
      uses: docker/login-action@v3
      with:
        registry: quay.io
        username: ${{ secrets.QUAY_USERNAME }}
        password: ${{ secrets.QUAY_PASSWORD }}
    - name: Build and push
      if: startsWith(github.ref, 'refs/tags/')
      id: build-push
      uses: docker/build-push-action@v5
      with:
        context: .
        push: ${{ github.event_name != 'pull_request' }}
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
    - uses: sigstore/cosign-installer@v3.3.0
    - name: cosign
      if: ${{ github.event_name != 'pull_request' && startsWith(github.ref, 'refs/tags/')}}
      env:
        TAGS: ${{ steps.meta.outputs.tags }}
        DIGEST: ${{ steps.build-push.outputs.digest }}
      run: cosign sign --yes "${TAGS}@${DIGEST}"