go-google.yaml

name: Go Salsa with ephemeral keyless Google Token Action
on: [ push ]

env:
  IMAGE: ttl.sh/salsa/gogoogletestapp:1h
  CONTEXT: ci/golang

jobs:
  build-go-google:
    permissions:
      contents: 'read'
      id-token: 'write'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Build and push
        id: docker_build
        uses: docker/build-push-action@v4
        with:
          push: true
          tags: ${{ env.IMAGE }}
          context: ./${{ env.CONTEXT }}

      - name: Install Go
        uses: actions/setup-go@v4
        with:
          go-version-file: ${{ env.CONTEXT }}/go.mod
          cache-dependency-path: ${{ env.CONTEXT }}/go.sum
          cache: true

      - name: Generate, sign and upload SBOM
        uses: ./
        with:
          image: ${{ env.IMAGE }}@${{ steps.docker_build.outputs.digest }}
          build-context: ${{ env.CONTEXT }}
          workload-identity-provider: ${{ secrets.SLSA_WORKLOAD_IDENTITY_PROVIDER }}
          google-service-account: cosign-keyless@plattformsikkerhet-dev-496e.iam.gserviceaccount.com