build.yml

---
name: build rwalk

"on":
  workflow_dispatch:
  push:
    branches:
      - master
    paths-ignore:
      - LICENSE
      - README.md
      - fly.toml
      - .github/workflows/build.yml
      - .github/workflows/deploy.yml
      - .github/workflows/digesta.yml
      - .github/dependabot.yml

permissions:
  contents: read
  id-token: write
  packages: write

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  BASE_IMAGE: cgr.dev/chainguard/python

jobs:
  build:
    name: build rwalk
    runs-on: ubuntu-latest
    steps:
      - name: checkout project
        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
      - name: setup python
        uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1
        with:
          python-version: '3.9'
      - name: install poetry
        uses: snok/install-poetry@93ada01c735cc8a383ce0ce2ae205a21c415379b
        with:
          virtualenvs-create: false
      - name: export requirements.txt
        run: |
          poetry export -o requirements.txt
      - name: install cosign
        uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19
      - name: verify base images
        run: |
          cosign dockerfile verify \
            --certificate-identity \
            'https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main' \
            --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
            Dockerfile | jq .
      - name: docker buildx
        id: buildx
        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226
      - name: login ghcr.io
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: docker metadata
        id: meta
        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934
        with:
          images: ${{ env.IMAGE_NAME }}
      - name: build rwalk (devel)
        id: docker
        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09
        with:
          context: .
          push: true
          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:devel
          labels: ${{ steps.meta.outputs.labels }}
          builder: ${{ steps.buildx.outputs.name }}
          sbom: true
          provenance: true
      - name: smoke test
        run: |
          set -x
          docker run --rm --detach -p 8080:8080 --name smoke_rwalk \
            "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.docker.outputs.digest }}"
          sleep 3
          curl -X GET http://localhost:8080 || (docker logs smoke_rwalk && exit 1)
          docker logs smoke_rwalk
          docker stop smoke_rwalk
      - name: cosign rwalk
        run: |
          cosign sign -y "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.docker.outputs.digest }}"
      - name: install crane
        uses: imjasonh/setup-crane@00c9e93efa4e1138c9a7a5c594acd6c75a2fbf0c
      - name: tag rwalk (latest)
        run: |
          crane tag "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:devel" latest