publish.yml

name: Build and Publish Docker Image

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: 'Tag for the Docker image (default: latest)'
        required: false
        default: 'latest'

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v4

      - name: Set up Go
        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
        with:
          go-version-file: 'go.mod'

      - name: Compute version number
        id: version-string
        run: |
          if [[ "${{ github.ref }}" == refs/tags/* ]]; then
            # For tags, use the tag as is
            TAG="${{ github.ref_name }}"
          else
            # Fallback to using the input tag
            TAG="${{ github.event.inputs.tag }}"
          fi
          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
          echo "Using tag: $TAG"

      - name: Log in to the Container registry
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup ko
        uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9

      - name: Install Cosign
        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0

      - name: Build and Push Image to GHCR
        run: |
          BASE_REPO=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          TAG=$(echo "${{ steps.version-string.outputs.tag }}" | sed 's/+/_/g')
          TAGS="-t $TAG"

          # Add latest tag only if building from a tag
          if [[ "${{ github.ref }}" == refs/tags/* ]]; then
            TAGS="$TAGS -t latest"
          fi

          KO_DOCKER_REPO=$BASE_REPO ko build --platform=linux/amd64,linux/arm64 --bare $TAGS ./ \
            --image-label=org.opencontainers.image.source=https://github.com/stacklok/frizbee-action,org.opencontainers.image.title="frizbee-action",org.opencontainers.image.vendor=Stacklok

      - name: Sign Image with Cosign
        run: |
          BASE_REPO=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          TAG=$(echo "${{ steps.version-string.outputs.tag }}" | sed 's/+/_/g')
          # Sign the ko image
          cosign sign -y $BASE_REPO:$TAG

          # Sign the latest tag if building from a tag
          if [[ "${{ github.ref }}" == refs/tags/* ]]; then
            cosign sign -y $BASE_REPO:latest
          fi