build.yml

name: build

on:
  push:

  workflow_dispatch:

env:
  OWNER: ${{ github.repository_owner }}
  FILE: nginx
  IMAGE: ghcr.io/${{ github.repository_owner }}/nginx
  BUILDKIT_PROGRESS: plain

concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:

  build:
    runs-on: ubuntu-latest

    timeout-minutes: 30

    permissions:
      attestations: write
      contents: read
      id-token: write
      packages: write

    env:
      TAG: latest

    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Init
        run: ./bin/init.sh
        shell: bash

      - name: docker-config
        uses: containerbase/internal-tools@b148c6616ae3d347c8ef9c15e4173d8363986f14 # v3.14.8
        with:
          command: docker-config

      - name: fetch docker file
        run: curl --retry 3 -fsSL -o base.Dockerfile https://raw.githubusercontent.com/nginx/docker-nginx/HEAD/modules/Dockerfile.alpine

      - name: Build the Docker image
        run: docker buildx bake test

      - name: Test run
        run: docker compose --file docker-compose.test.yml run sut
        env:
          IMAGE: ${{ env.IMAGE }}:${{ env.TAG }}

      - name: Log into registry
        if: github.ref_name == 'main'
        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin

      - name: Publish the Docker image
        if: github.ref_name == 'main'
        run: |
          docker buildx bake --metadata-file /tmp/meta.json build
          jq . /tmp/meta.json
          digest=$(jq -r '.push_ghcr.["containerimage.digest"]' /tmp/meta.json)
          echo "digest=$digest" >> "$GITHUB_ENV"

      - name: Attest the Docker image
        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
        if: github.ref_name == 'main'
        with:
          subject-name: ${{ env.IMAGE }}
          subject-digest: ${{ env.digest }}
          push-to-registry: true

  release:
    needs: build

    permissions:
      contents: write

    runs-on: ubuntu-latest
    if: github.ref_name == 'main'

    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Init
        run: ./bin/init.sh

      - uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b # v1.20.0
        with:
          allowUpdates: true
          body: See https://github.com/nginx/nginx/releases/tag/release-${{ env.VERSION }} for more changes
          commit: ${{ github.sha }}
          name: ${{ env.VERSION }}
          tag: v${{ env.VERSION }}
          token: ${{ secrets.GITHUB_TOKEN }}