release-publish.yml

# SPDX-FileCopyrightText: 2024 Digg - The Agency for Digital Government
#
# SPDX-License-Identifier: CC0-1.0

# TO-DO: make this part of jrelaser flow instead

name: Publish Container Image with SLSA

on:
  workflow_call: # yamllint disable-line rule:truthy

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  REPO_NAME: eudiw-wallet-issuer-poc

jobs:
  publish-container:
    name: Build and Publish Container Image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write  # Required for SLSA provenance
      actions: read   # Required for SLSA provenance v2

    outputs:
      image: ${{ steps.image.outputs.image }}
      digest: ${{ steps.build.outputs.digest }}
    
    steps:
      - name: Checkout Repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
        with:
          ref: main

      - name: Configure QEMU
        uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a # v3

      - name: Configure Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3

      - name: Set up JDK
        uses: actions/setup-java@7a6d8a8234af8eb26422e24e3006232cccaa061b # v4.6.0
        with:
          java-version: 21
          distribution: 'temurin'  
          cache: 'maven'  # Enables Maven caching

      - name: Build Jar
        env: 
          GITHUB_ACTOR: ${{ github.actor }}
          PACKAGE_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          mvn $MAVEN_CLI_OPTS package -DskipTests
                  
      - name: Verify Build Platform Support
        run: |
          echo "Platforms: ${{ steps.buildx.outputs.platforms }}"
          ls -R 

      - name: Authenticate with Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Image Metadata
        id: metadata
        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          flavor: |
            latest=false
          tags: |
            type=raw,value={{branch}},priority=1,enable=${{ !startsWith(github.ref, 'refs/tags/v') }}
            type=semver,pattern={{version}},priority=2
            type=raw,value=${{ env.REPO_NAME }}-{{branch}}-{{date 'YYYYMMDD'}}-{{sha}},priority=31,enable=${{ !startsWith(github.ref, 'refs/tags/v') }}
            type=raw,value=${{ env.REPO_NAME }}-{{tag}}-{{date 'YYYYMMDD'}}-{{sha}},priority=32,enable=${{ startsWith(github.ref, 'refs/tags/v') }}

      - name: Build and Push Container Image
        id: build
        uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6
        with:
          context: .
          file: Containerfile
          platforms: linux/amd64,linux/arm64
          push: true
          tags: ${{ steps.metadata.outputs.tags }}
          labels: ${{ steps.metadata.outputs.labels }}
          provenance: false  # Enable SLSA provenance
          sbom: true       # Generate SBOM
     

      - name: Output image
        id: image
        run: |
          # NOTE: Set the image as an output because the `env` context is not
          # available to the inputs of a reusable workflow call.
          # shellcheck disable=SC2153
          image_name="${REGISTRY}/${IMAGE_NAME}"
          echo "image=$image_name" >> "$GITHUB_OUTPUT"

  # This step calls the container workflow to generate provenance and push it to
  # the container registry.
  provenance:
    needs: [publish-container]
    permissions:
      actions: read # for detecting the Github Actions environment.
      id-token: write # for creating OIDC tokens for signing.
      packages: write # for uploading attestations.
    if: startsWith(github.ref, 'refs/tags/')
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0
    with:
      image: ${{ needs.publish-container.outputs.image }}
      digest: ${{ needs.publish-container.outputs.digest }}
      registry-username: ${{ github.actor }}
    secrets:
      registry-password: ${{ secrets.GITHUB_TOKEN }}