images-updater-core.yml

name: Updater-Core image
env:
  UPDATER_CORE_IMAGE: "ghcr.io/dependabot/dependabot-updater-core"
on: # yamllint disable-line rule:truthy
  push:
    branches:
      - main
    tags:
      - v[0-9]+.[0-9]+.[0-9]+
jobs:
  push-updater-core-image:
    name: Push dependabot-updater-core image to GHCR
    runs-on: ubuntu-latest
    if: github.repository == 'dependabot/dependabot-core'
    permissions:
      contents: read
      id-token: write
      packages: write
    steps:
      - name: Checkout code
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
        with:
          submodules: recursive

      - uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0

      - name: Build dependabot-updater-core image
        run: script/build common
      - name: Log in to GHCR
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
      - name: Push latest image
        run: |
          docker push "$UPDATER_CORE_IMAGE:latest"
          cosign sign --yes $(cosign triangulate --type=digest "$UPDATER_CORE_IMAGE:latest")

      - name: Push tagged image
        if: contains(github.ref, 'refs/tags')
        run: |
          VERSION="$(grep -Eo "[0-9]+\.[0-9]+\.[0-9]+" common/lib/dependabot.rb)"
          docker tag "$UPDATER_CORE_IMAGE:latest" "$UPDATER_CORE_IMAGE:$VERSION"
          docker push "$UPDATER_CORE_IMAGE:$VERSION"