fix: address Gemini review on #16 #22
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # OCI image flow: | |
| # 1. push to main -> build + push :edge (multi-arch) | |
| # 2. tag v* -> build + push :v<tag> and update :latest | |
| # 3. cosign keyless signs the image manifest | |
| # | |
| # secrets: none. credentials are minted via OIDC per run. | |
| name: oci | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ["v*"] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: {} | |
| jobs: | |
| image: | |
| name: build + push image | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| steps: | |
| - name: harden runner | |
| uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 | |
| - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 | |
| - name: log in to ghcr (push events only) | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: derive tags | |
| id: tags | |
| run: | | |
| set -euo pipefail | |
| repo="ghcr.io/${GITHUB_REPOSITORY,,}" | |
| if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then | |
| tag="${GITHUB_REF_NAME}" | |
| echo "tags=${repo}:${tag},${repo}:latest" >>"$GITHUB_OUTPUT" | |
| else | |
| echo "tags=${repo}:edge" >>"$GITHUB_OUTPUT" | |
| fi | |
| - name: build (and push for non-PR events) | |
| id: build | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 | |
| with: | |
| context: . | |
| file: Dockerfile | |
| platforms: linux/amd64,linux/arm64 | |
| push: ${{ github.event_name != 'pull_request' }} | |
| tags: ${{ steps.tags.outputs.tags }} | |
| provenance: true | |
| sbom: true | |
| - name: install cosign | |
| if: github.event_name != 'pull_request' | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| - name: cosign sign manifest | |
| if: github.event_name != 'pull_request' | |
| env: | |
| DIGEST: ${{ steps.build.outputs.digest }} | |
| TAGS: ${{ steps.tags.outputs.tags }} | |
| COSIGN_EXPERIMENTAL: "1" | |
| run: | | |
| set -euo pipefail | |
| IFS=',' read -ra refs <<<"$TAGS" | |
| for ref in "${refs[@]}"; do | |
| cosign sign --yes "${ref}@${DIGEST}" | |
| done |