release-image.yaml

name: Release falco_plugin (OCI)

on:
  release:
    types: [published]

permissions:
  contents: read # Default token to read


jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write

    steps:
      - name: harden runner
        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          egress-policy: audit

      - name: install cosign
        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0

      - name: checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 6.0.2
        with:
          persist-credentials: false

      - name: Set up QEMU
        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a #v3.6

      - name: docker setup buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

      - name: docker login ghcr.io
        if: github.event_name != 'pull_request'
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
        with:
          registry: ghcr.io
          username: "${{ github.actor }}"
          password: '${{ github.token }}'

      - name: extract metadata
        id: meta
        working-directory: ${{ env.CONTAINERFILE_DIR }}
        run: |
          REPO_NAME=${{ github.event.repository.name }}
          FULL_IMAGE_NAME=ghcr.io/${{ github.repository_owner }}/edera_falco_plugin
          echo "full-image-name=${FULL_IMAGE_NAME,,}" >> $GITHUB_OUTPUT

          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
            TAGS="${FULL_IMAGE_NAME,,}:pr-${{ github.event.number }}"
          else
            TAGS="${FULL_IMAGE_NAME,,}:${{ github.sha }},${FULL_IMAGE_NAME,,}:latest"
          fi
          echo "tags=${TAGS}" >> $GITHUB_OUTPUT

      - name: build and push Docker image
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
        id: push
        with:
          context: .
          file: ./Containerfile
          platforms: "linux/amd64,linux/arm64"
          push: ${{ github.event_name != 'pull_request' }}
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          labels: |
            org.opencontainers.image.title=${{ steps.meta.outputs.target-name }}
            org.opencontainers.image.source=${{ github.event.repository.html_url }}
            org.opencontainers.image.revision=${{ github.sha }}

      - name: cosign all images
        if: github.event_name != 'pull_request'
        shell: bash
        run: |
          IFS=',' read -ra TAGS <<< '${{ steps.meta.outputs.tags }}'
          for tag in "${TAGS[@]}"; do
            pullstring="${tag}@${{ steps.push.outputs.digest }}"
            echo "Signing ${pullstring}"
            cosign sign --yes "${pullstring}"
          done
        env:
          DIGEST: '${{ steps.push.outputs.digest }}'
          COSIGN_EXPERIMENTAL: 'true'