publish.yaml

name: Publish

on:
  push:
    branches: [main]
    tags:
      - "v*.*.*"
env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  CONTAINER_TAR: "container.tar"
jobs:
    paranoia-inception:
      runs-on: ubuntu-latest
      outputs:
        image: ${{ steps.build-and-push.outputs.image }}
        digest: ${{ steps.build-and-push.outputs.digest }}
      permissions:
        contents: read
        packages: write
        id-token: write # for creating OIDC tokens for signing.
      steps:
        - name: Log in to the Container registry
          uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d
          with:
            registry: ${{ env.REGISTRY }}
            username: ${{ github.actor }}
            password: ${{ secrets.GITHUB_TOKEN }}

        - name: "Checkout code"
          uses: actions/checkout@v4

        - name: Set up QEMU
          uses: docker/setup-qemu-action@v2

        - name: Set up Docker Buildx
          uses: docker/setup-buildx-action@v3

        # Install the cosign tool except on PR
        # https://github.com/sigstore/cosign-installer
        - name: Install cosign
          uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 #v3.0.3
          with:
            cosign-release: 'v2.0.2'


        - name: Extract metadata (tags, labels) for Docker
          id: meta
          uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81
          with:
            images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
            tags: |
              type=edge,branch=main
              type=ref,event=tag

        - name: Build and export to Docker
          uses: docker/build-push-action@v5
          with:
            context: .
            load: true
            cache-from: type=gha
            cache-to: type=gha,mode=max
            outputs: type=docker,dest=${{ env.CONTAINER_TAR }}

        - name: "Run Paranoia container"
          uses: ./
          with:
            target_tar: file://${{ env.CONTAINER_TAR }}

        - name: Build and push
          uses: docker/build-push-action@v5
          id: build-and-push
          with:
            context: .
            platforms: linux/amd64,linux/arm64
            push: true
            tags: ${{ steps.meta.outputs.tags }}
            labels: ${{ steps.meta.outputs.labels }}
            cache-from: type=gha
            cache-to: type=gha,mode=max

        # Sign the resulting Docker image digest except on PRs.
        # This will only write to the public Rekor transparency log when the Docker
        # repository is public to avoid leaking data.  If you would like to publish
        # transparency data even for private images, pass --force to cosign below.
        # https://github.com/sigstore/cosign
        - name: Sign the published Docker image
          # This step uses the identity token to provision an ephemeral certificate
          # against the sigstore community Fulcio instance.
          env:
            TAGS: ${{ steps.meta.outputs.tags }}
            DIGEST: ${{ steps.build-and-push.outputs.digest }}
          run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
    
    provenance-for-images:
      needs: [paranoia-inception]
      permissions:
        actions: read # for detecting the Github Actions environment.
        id-token: write # for creating OIDC tokens for signing.
        packages: write # for uploading attestations.
      uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.9.0
      with:
        image: ghcr.io/${{ github.repository }}
        # The image digest is used to prevent TOCTOU issues.
        # This is an output of the docker/build-push-action
        # See: https://github.com/slsa-framework/slsa-verifier#toctou-attacks
        digest: ${{ needs.paranoia-inception.outputs.digest }}
        registry-username: ${{ github.actor }}
      secrets:
        registry-password: ${{ secrets.GITHUB_TOKEN }}