go-github.yaml

name: Go Salsa with ephemeral keyless GitHub Token Action
on: [ push ]

env:
  IMAGE: ttl.sh/salsa/gogithubtestapp:1h
  CONTEXT: ci/golang

jobs:
  build-go-github:
    permissions:
      contents: 'read'
      id-token: 'write'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Build and push
        id: docker_build
        uses: docker/build-push-action@v4
        with:
          push: true
          tags: ${{ env.IMAGE }}
          context: ./${{ env.CONTEXT }}

      - name: Install Go
        uses: actions/setup-go@v4
        with:
          go-version-file: ${{ env.CONTEXT }}/go.mod
          cache-dependency-path: ${{ env.CONTEXT }}/go.sum
          cache: true

      - name: Generate, sign and upload SBOM
        uses: ./
        with:
          image: ${{ env.IMAGE }}@${{ steps.docker_build.outputs.digest }}
          build-context: ${{ env.CONTEXT }}