docker-publish.yml

name: docker publish

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

on:
  schedule:
    - cron: '44 9 * * *'
  push:
    branches: [ main ]
    # Publish semver tags as releases.
    tags: [ 'v*.*.*' ]
  pull_request:
    branches: [ main ]

env:
  # Use docker.io for Docker Hub if empty
  REGISTRY: ghcr.io
  # github.repository as <account>/<repo>
  IMAGE_NAME: ${{ github.repository }}
  # github repository name as <repo>
  #  might even be set through echo "$GITHUB_REPOSITORY" | awk -F / '{print $2}' | sed -e "s/:refs//" if usernames on GitHub and DockerHub are identical
  DOCKERHUB_IMAGE_NAME: docker-edirom-online

  # Edirom Online
  EDIROM_REPO: baz-ga/Edirom-Online
  EDIROM_BRANCH: bazga/dev
  EDIROM_DIR: edirom-dir


jobs:
  build-edirom:
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
    - name: Checkout Edirom Online repository
      uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
      with:
        path: ${{ env.EDIROM_DIR }}
        ref: ${{ env.EDIROM_BRANCH }}
        repository: ${{ env.EDIROM_REPO }}
        submodules: 'recursive'

    - name: Build Edirom Online from ${{ github.ref }} at ${{ github.sha }}
      run: |
        cd ${{ env.EDIROM_DIR }}
        docker run --rm -v $(pwd):/app -w /app --entrypoint ./build.sh bwbohl/sencha-cmd

    #- name: Get short sha
    #  uses: benjlevesque/short-sha@599815c8ee942a9616c92bcfb4f947a3b670ab0b # v3.0
    #  id: short-sha
    #  with:
    #    length: 7

    #- name: Build Edirom Online from ${{ github.ref }} at ${{ github.sha }}
    #  run: docker run --rm -v $(pwd):/app -w /app --entrypoint ./build.sh bwbohl/sencha-cmd

    - name: Upload Edirom Online artifact
      uses: actions/upload-artifact@v4
      with:
        if-no-files-found: 'error'
        path: ${{ github.workspace }}/${{ env.EDIROM_DIR }}/build-xar/Edirom-Online-*.xar
        retention-days: 90


  build:
    needs: build-edirom
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      # This is used to complete the identity challenge
      # with sigstore/fulcio when running outside of PRs.
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Download Edirom artifact
        uses: actions/download-artifact@v4
        with:
          path: add-xars
          #pattern: Edirom-Online*.xar

      - name: list downloaded files
        run: ls -R add-xars

      # Install the cosign tool except on PR
      # https://github.com/sigstore/cosign-installer
      - name: Install cosign
        if: github.event_name != 'pull_request'
        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20
        with:
          cosign-release: 'v2.2.4'

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      # Workaround: https://github.com/docker/build-push-action/issues/461
      - name: Setup Docker buildx
        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb

      # Login against a Docker registry except on PR
      # https://github.com/docker/login-action
      - name: Log into registry ${{ env.REGISTRY }}
        if: github.event_name != 'pull_request'
        uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Login against DockerHub registry except on PR
      #- name: Log in to DockerHub
      #  if: github.event_name != 'pull_request'
      #  uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446
      #  with:
      #    username: ${{ secrets.BWBOHL_DOCKERHUB_USERNAME }}
      #    password: ${{ secrets.BWBOHL_DOCKERHUB_TOKEN }}

      # Extract metadata (tags, labels) for Docker
      # https://github.com/docker/metadata-action
      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81
        with:
          #images: |
          #  ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          #  ${{ secrets.BWBOHL_DOCKERHUB_USERNAME }}/${{ env.DOCKERHUB_IMAGE_NAME }}
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          flavor: |
            latest=${{ github.ref == 'refs/heads/main' }}
      # Build and push Docker image with Buildx (don't push on PR)
      # https://github.com/docker/build-push-action
      - name: Build and push Docker image
        id: build-and-push
        uses: docker/build-push-action@15560696de535e4014efeff63c48f16952e52dd1
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
          platforms: |
            linux/amd64
            linux/arm64/v8
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          build-args: EDIROM_VERSION=dev

      # Sign the resulting Docker image digest except on PRs.
      # This will only write to the public Rekor transparency log when the Docker
      # repository is public to avoid leaking data.  If you would like to publish
      # transparency data even for private images, pass --force to cosign below.
      # https://github.com/sigstore/cosign
      - name: Sign the images with GitHub OIDC Token
        if: github.event_name != 'pull_request'
        env:
          DIGEST: ${{ steps.build-and-push.outputs.digest }}
          TAGS: ${{ steps.meta.outputs.tags }}
        run: |
          images=""
          for tag in ${TAGS}; do
            images+="${tag}@${DIGEST} "
          done
          cosign sign --yes ${images}