chainguard.yml

name: Build e Distribuição de Pacotes com Melange e APKO

on:
  push:
    branches:
      - 'main'

jobs:
  build:
    name: Build e Distribuição de Pacotes
    runs-on: ubuntu-20.04
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - name: Fazer checkout do código
        uses: actions/checkout@v3

      - name: Configurar QEMU
        uses: docker/setup-qemu-action@v3

      - name: Instalar Cosign
        uses: sigstore/cosign-installer@v3

      - name: Configurar Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Fazer login no Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Install Melange
        run: |
          wget https://github.com/chainguard-dev/melange/releases/download/v0.11.2/melange_0.11.2_linux_386.tar.gz
          tar -xzf melange_0.11.2_linux_386.tar.gz
          cd melange_0.11.2_linux_386
          sudo mv melange /usr/local/bin/
          sudo chmod +x /usr/local/bin/melange
          melange version

      - name: Install APKO
        run: |
          wget https://github.com/chainguard-dev/apko/releases/download/v0.14.7/apko_0.14.7_linux_386.tar.gz
          tar -xzf apko_0.14.7_linux_386.tar.gz
          cd apko_0.14.7_linux_386
          sudo mv apko /usr/local/bin/
          sudo chmod +x /usr/local/bin/apko
          apko --version

      - name: Gerar chaves com Melange
        run: |
          cd chainguard
          melange keygen

      - name: Construir pacotes com Melange
        run: |
          cd chainguard
          melange build melange.yaml --runner docker --signing-key melange.rsa --arch amd64

      - name: Construir imagem de container com APKO
        run: |
          cd chainguard
          apko build apko.yaml senhas:v1.0.0 giropops-senhas.tar -k melange.rsa.pub --arch amd64

      - name: Carregar a imagem Docker
        run: |
          docker load < chainguard/giropops-senhas.tar

      - name: Extrair metadados (tags, labels) para Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ secrets.DOCKER_USERNAME }}/giropops-senhas

      - name: Gerar nome único para a tag
        id: generate-tag
        run: |
          SHORT_HASH=$(git log -1 --pretty=format:%h | cut -c1-5)
          TIMESTAMP=$(date +%Y%m%d%H%M%S)
          echo "tag=${SHORT_HASH}-${TIMESTAMP}" >> $GITHUB_ENV
          echo "::set-output name=tag::${SHORT_HASH}-${TIMESTAMP}"