build.yml

---
name: build rwalk

"on":
  workflow_dispatch:
  push:
    branches:
      - master
    paths-ignore:
      - LICENSE
      - README.md
      - fly.toml
      - .github/workflows/build.yml
      - .github/workflows/deploy.yml
      - .github/workflows/digesta.yml
      - .github/dependabot.yml

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build:
    name: build rwalk
    permissions:
      contents: read
      packages: write
    outputs:
      digest: ${{ steps.docker.outputs.digest }}
    runs-on: ubuntu-latest
    steps:
      - name: checkout project
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
      - name: setup python
        uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c
        with:
          python-version: '3.9'
      - name: install poetry
        uses: snok/install-poetry@93ada01c735cc8a383ce0ce2ae205a21c415379b
        with:
          virtualenvs-create: false
      - name: export requirements.txt
        run: |
          poetry export -o requirements.txt
      - name: install cosign
        uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4
      - name: verify base images
        run: |
          cosign dockerfile verify \
            --certificate-identity \
            'https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main' \
            --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
            Dockerfile | jq .
      - name: docker buildx
        id: buildx
        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226
      - name: login ghcr.io
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: docker metadata
        id: meta
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81
        with:
          images: ${{ env.IMAGE_NAME }}
      - name: build rwalk (devel)
        id: docker
        uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56
        with:
          context: .
          push: true
          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:devel
          labels: ${{ steps.meta.outputs.labels }}
          builder: ${{ steps.buildx.outputs.name }}
          sbom: true
          provenance: true
      - name: smoke test
        run: |
          set -x
          docker run --rm --detach -p 8080:8080 --name smoke_rwalk \
            "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.docker.outputs.digest }}"
          sleep 3
          curl -X GET http://localhost:8080 || (docker logs smoke_rwalk && exit 1)
          docker logs smoke_rwalk
          docker stop smoke_rwalk
  cosign:
    name: cosign rwalk
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      packages: write
    needs: build
    steps:
      - name: install cosign
        uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4
      - name: login ghcr.io
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: cosign rwalk
        run: |
          cosign sign -y "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build.outputs.digest }}"
      - name: install crane
        uses: imjasonh/setup-crane@00c9e93efa4e1138c9a7a5c594acd6c75a2fbf0c
      - name: tag rwalk (latest)
        run: |
          crane tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:devel" latest