image.yaml

name: image

on:
  push:
    branches:
      - 'main'
  workflow_dispatch:

permissions:
  contents: read
  packages: write
  id-token: write

jobs:
  image:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version-file: 'go.mod'
          check-latest: true
      - uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0

      # Build ko from HEAD, build and push an image tagged with the commit SHA,
      # then keylessly sign it with cosign.
      - name: Publish and sign image
        env:
          KO_DOCKER_REPO: ghcr.io/${{ github.repository }}
          COSIGN_EXPERIMENTAL: 'true'
        run: |
          go build ./
          echo "${{ github.token }}" | ./ko login ghcr.io --username "${{ github.actor }}" --password-stdin
          img=$(./ko build --bare --platform=all -t latest -t ${{ github.sha }} ./)
          echo "built ${img}"
          cosign sign ${img} --yes \
              -a sha=${{ github.sha }} \
              -a run_id=${{ github.run_id }} \
              -a run_attempt=${{ github.run_attempt }}