build-and-push.yaml

# Builds and pushes docker images on main and tags

name: Build and Push Docker images
on:
  push:
    branches:
      - main
      - "release/**"
      - "docker/**"
    paths:
      - "Makefile"
      - "pom.xml"
      - ".github/workflows/build-and-push.yaml"
      - "config"
      - "src/**"
    tags:
      - '*'

jobs:
  build:
    if: github.repository == 'geoserver/geoserver-cloud'
    name: Build and Push
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
    - name: Install Cosign
      uses: sigstore/cosign-installer@v3.5.0

    - name: Login to Docker Hub
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKER_HUB_USERNAME }}
        password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}

    # Add support for more platforms with QEMU
    # https://github.com/docker/setup-qemu-action
    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
      # https://github.com/docker/setup-buildx-action
      with:
        platforms: linux/amd64,linux/arm64
        # Sets up docker build command as an alias to docker buildx
        install: true

    - name: Checkout
      uses: actions/checkout@v4
      with:
        submodules: recursive

    - name: Setup Java
      uses: actions/setup-java@v4
      with:
        distribution: 'temurin'
        java-version: '21'
        cache: 'maven'

    - name: Build without tests
      run: |
        make install

    - name: Build and push images
      run: |
        COMPOSE_BUILD_ARGS=--push make build-image

    - name: Remove project jars from cached repository
      run: |
        rm -rf ~/.m2/repository/org/geoserver
        find ~/.m2/repository -name "*SNAPSHOT*" -type d | xargs rm -rf {}

    - name: Sign images
      if: ${{ startsWith(github.ref, 'refs/tags/') }}
      env:
        COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
        COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
      run: |
        make sign-image

    - name: Verify image signatures
      if: ${{ startsWith(github.ref, 'refs/tags/') }}
      env:
        COSIGN_PUB_KEY: ${{ secrets.COSIGN_PUB_KEY }}
        COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
      run: |
        make verify-image