push-image.yaml

# https://docs.github.com/en/packages/managing-github-packages-using-github-actions-workflows/publishing-and-installing-a-package-with-github-actions#upgrading-a-workflow-that-accesses-a-registry-using-a-personal-access-token
name: Build Image
on:
  push:
    branches:
      - main
    tags:
      - image/v*
  pull_request:

env:
  IMAGE: ghcr.io/${{ github.repository_owner }}/checkton

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      # id-token: write
      # attestations: write
      packages: write
      contents: read

    steps:
      - uses: actions/checkout@v4

      - name: Build image
        uses: redhat-actions/buildah-build@v2
        with:
          containerfiles: Dockerfile
          image: ${{ env.IMAGE }}
          tags: |
            latest
            test

      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: ${{ env.IMAGE }}
          format: cyclonedx-json
          output-file: .sbom.json
          upload-artifact: false
          upload-release-assets: false

      - name: Push image
        id: push
        uses: redhat-actions/push-to-registry@v2
        with:
          tags: ${{ env.IMAGE }}:test
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

#           version=""
#           if [[ "$GITHUB_REF" == refs/tags/image/v*.*.* ]]; then
#             version=$(basename "$GITHUB_REF")
#           fi

#           podman tag "$IMAGE:latest" "$IMAGE:$GITHUB_SHA"
#           podman tag "$IMAGE:latest" "$IMAGE:test"
#           podman push "$IMAGE:test"
#           # podman push "$IMAGE:$GITHUB_SHA"
#           # if [[ -n "$version" ]]; then
#           #   skopeo copy "$IMAGE:$GITHUB_SHA" "$IMAGE:$version"
#           # fi

      - name: Generate attestation
        uses: actions/attest-build-provenance@v1
        with:
          subject-name: ${{ env.IMAGE }}
          subject-digest: ${{ steps.push.outputs.digest }}
          sbom-path: .sbom.json
          push-to-registry: true