|  | 
|  | 1 | +name: Docker | 
|  | 2 | + | 
|  | 3 | +# This workflow uses actions that are not certified by GitHub. | 
|  | 4 | +# They are provided by a third-party and are governed by | 
|  | 5 | +# separate terms of service, privacy policy, and support | 
|  | 6 | +# documentation. | 
|  | 7 | + | 
|  | 8 | +on: | 
|  | 9 | +  schedule: | 
|  | 10 | +    - cron: '23 21 * * *' | 
|  | 11 | +  push: | 
|  | 12 | +    branches: [ "main" ] | 
|  | 13 | +    # Publish semver tags as releases. | 
|  | 14 | +    tags: [ 'v*.*.*' ] | 
|  | 15 | +  pull_request: | 
|  | 16 | +    branches: [ "main" ] | 
|  | 17 | + | 
|  | 18 | +env: | 
|  | 19 | +  # Use docker.io for Docker Hub if empty | 
|  | 20 | +  REGISTRY: ghcr.io | 
|  | 21 | +  # github.repository as <account>/<repo> | 
|  | 22 | +  IMAGE_NAME: ${{ github.repository }} | 
|  | 23 | + | 
|  | 24 | + | 
|  | 25 | +jobs: | 
|  | 26 | +  build: | 
|  | 27 | + | 
|  | 28 | +    runs-on: ubuntu-latest | 
|  | 29 | +    permissions: | 
|  | 30 | +      contents: read | 
|  | 31 | +      packages: write | 
|  | 32 | +      # This is used to complete the identity challenge | 
|  | 33 | +      # with sigstore/fulcio when running outside of PRs. | 
|  | 34 | +      id-token: write | 
|  | 35 | + | 
|  | 36 | +    steps: | 
|  | 37 | +      - name: Checkout repository | 
|  | 38 | +        uses: actions/checkout@v4 | 
|  | 39 | + | 
|  | 40 | +      # Install the cosign tool except on PR | 
|  | 41 | +      # https://github.com/sigstore/cosign-installer | 
|  | 42 | +      - name: Install cosign | 
|  | 43 | +        if: github.event_name != 'pull_request' | 
|  | 44 | +        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0 | 
|  | 45 | +        with: | 
|  | 46 | +          cosign-release: 'v2.2.4' | 
|  | 47 | + | 
|  | 48 | +      # Set up BuildKit Docker container builder to be able to build | 
|  | 49 | +      # multi-platform images and export cache | 
|  | 50 | +      # https://github.com/docker/setup-buildx-action | 
|  | 51 | +      - name: Set up Docker Buildx | 
|  | 52 | +        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0 | 
|  | 53 | + | 
|  | 54 | +      # Login against a Docker registry except on PR | 
|  | 55 | +      # https://github.com/docker/login-action | 
|  | 56 | +      - name: Log into registry ${{ env.REGISTRY }} | 
|  | 57 | +        if: github.event_name != 'pull_request' | 
|  | 58 | +        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 | 
|  | 59 | +        with: | 
|  | 60 | +          registry: ${{ env.REGISTRY }} | 
|  | 61 | +          username: ${{ github.actor }} | 
|  | 62 | +          password: ${{ secrets.GITHUB_TOKEN }} | 
|  | 63 | + | 
|  | 64 | +      # Extract metadata (tags, labels) for Docker | 
|  | 65 | +      # https://github.com/docker/metadata-action | 
|  | 66 | +      - name: Extract Docker metadata | 
|  | 67 | +        id: meta | 
|  | 68 | +        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0 | 
|  | 69 | +        with: | 
|  | 70 | +          images: ghcr.io/socstech/MODULE # THIS LINE MUST BE EDITED FOR NEW MODULES | 
|  | 71 | + | 
|  | 72 | + | 
|  | 73 | +      # Build and push Docker image with Buildx (don't push on PR) | 
|  | 74 | +      # https://github.com/docker/build-push-action | 
|  | 75 | +      - name: Build and push Docker image | 
|  | 76 | +        id: build-and-push | 
|  | 77 | +        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0 | 
|  | 78 | +        with: | 
|  | 79 | +          context: . | 
|  | 80 | +          file: ./MODULE FOLDER/.devcontainer/Dockerfile # THIS LINE MUST BE EDITED FOR NEW MODULES | 
|  | 81 | +          push: ${{ github.event_name != 'pull_request' }} | 
|  | 82 | +          # THIS LINE MUST BE EDITED FOR NEW MODULES | 
|  | 83 | +          tags: | | 
|  | 84 | +            ${{ steps.meta.outputs.tags }} | 
|  | 85 | +            ghcr.io/socstech/MODULE:latest | 
|  | 86 | +          labels: ${{ steps.meta.outputs.labels }} | 
|  | 87 | +          cache-from: type=gha | 
|  | 88 | +          cache-to: type=gha,mode=max | 
|  | 89 | + | 
|  | 90 | +      # Sign the resulting Docker image digest except on PRs. | 
|  | 91 | +      # This will only write to the public Rekor transparency log when the Docker | 
|  | 92 | +      # repository is public to avoid leaking data.  If you would like to publish | 
|  | 93 | +      # transparency data even for private images, pass --force to cosign below. | 
|  | 94 | +      # https://github.com/sigstore/cosign | 
|  | 95 | +      - name: Sign the published Docker image | 
|  | 96 | +        if: ${{ github.event_name != 'pull_request' }} | 
|  | 97 | +        env: | 
|  | 98 | +          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable | 
|  | 99 | +          TAGS: ${{ steps.meta.outputs.tags }} | 
|  | 100 | +          DIGEST: ${{ steps.build-and-push.outputs.digest }} | 
|  | 101 | +        # This step uses the identity token to provision an ephemeral certificate | 
|  | 102 | +        # against the sigstore community Fulcio instance. | 
|  | 103 | +        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} | 
0 commit comments