build.yml

---
name: build rwalk

"on":
  workflow_dispatch:
  push:
    branches:
      - master
    paths-ignore:
      - LICENSE
      - README.md
      - fly.toml
      - .github/workflows/build.yml
      - .github/workflows/deploy.yml
      - .github/workflows/digesta.yml
      - .github/dependabot.yml

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build:
    name: build rwalk
    permissions:
      contents: read
      packages: write
    outputs:
      digest: ${{ steps.docker.outputs.digest }}
    runs-on: ubuntu-latest
    steps:
      - name: checkout project
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
      - name: setup python
        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d
        with:
          python-version: '3.9'
      - name: install poetry
        uses: snok/install-poetry@93ada01c735cc8a383ce0ce2ae205a21c415379b
        with:
          virtualenvs-create: false
      - name: export requirements.txt
        run: |
          poetry export -o requirements.txt
      - name: install cosign
        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20
      - name: verify base images
        run: |
          cosign dockerfile verify \
            --certificate-identity \
            'https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main' \
            --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
            Dockerfile | jq .
      - name: docker buildx
        id: buildx
        uses: docker/setup-buildx-action@4fd812986e6c8c2a69e18311145f9371337f27d4
      - name: login ghcr.io
        uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: docker metadata
        id: meta
        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81
        with:
          images: ${{ env.IMAGE_NAME }}
      - name: build rwalk (devel)
        id: docker
        uses: docker/build-push-action@1a162644f9a7e87d8f4b053101d1d9a712edc18c
        with:
          context: .
          push: true
          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:devel
          labels: ${{ steps.meta.outputs.labels }}
          builder: ${{ steps.buildx.outputs.name }}
          sbom: true
          provenance: true
      - name: smoke test
        run: |
          set -x
          docker run --rm --detach -p 8080:8080 --name smoke_rwalk \
            "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.docker.outputs.digest }}"
          sleep 3
          curl -X GET http://localhost:8080 || (docker logs smoke_rwalk && exit 1)
          docker logs smoke_rwalk
          docker stop smoke_rwalk
  cosign:
    name: cosign rwalk
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      packages: write
    needs: build
    steps:
      - name: install cosign
        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20
      - name: login ghcr.io
        uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: cosign rwalk
        run: |
          cosign sign -y "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build.outputs.digest }}"
      - name: install crane
        uses: imjasonh/setup-crane@31b88efe9de28ae0ffa220711af4b60be9435f6e
      - name: tag rwalk (latest)
        run: |
          crane tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:devel" latest