publish-package.yml

name: publish-ghcr

on:
  push:
    tags:
      - v*
  workflow_dispatch:

permissions: read-all

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      packages: write
      contents: read
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
      - name: prepare
        id: prepare
        run: |
          VERSION=${GITHUB_REF#refs/*/}
          BRANCH_NAME=${GITHUB_REF#refs/heads/}
          REPOSITORY=ghcr.io/${{ github.repository }}
          REPOSITORYBASE=ghcr.io/${{ github.repository }}-base
          REPOSITORYCRD=ghcr.io/${{ github.repository }}-crds
          if [[ "${VERSION}" == "${BRANCH_NAME}" ]]; then
            VERSION=$(git rev-parse --short HEAD)
          fi
          echo ::set-output name=version::${VERSION}
          echo ::set-output name=ref::${REPOSITORY}:${VERSION}
          echo ::set-output name=baseref::${REPOSITORYBASE}:${VERSION}
          echo ::set-output name=crdref::${REPOSITORYCRD}:${VERSION}
      - name: Get tag
        run: |
          echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
      - name: docker login
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: docker build ratify-crds
        run: |
          docker buildx create --use
          docker buildx build \
            --attest type=sbom \
            --attest type=provenance,mode=max \
            --build-arg KUBE_VERSION="1.29.2" \
            -f crd.Dockerfile \
            --platform linux/amd64,linux/arm64,linux/arm/v7 \
            --label org.opencontainers.image.revision=${{ github.sha }} \
            -t ${{ steps.prepare.outputs.crdref }} \
            --push ./charts/ratify/crds
      - name: docker build ratify base
        run: |
          docker buildx create --use         
          docker buildx build -f ./httpserver/Dockerfile \
            --attest type=sbom \
            --attest type=provenance,mode=max \
            --platform linux/amd64,linux/arm64,linux/arm/v7 \
            --build-arg LDFLAGS="-X github.com/ratify-project/ratify/internal/version.Version=$TAG" \
            --label org.opencontainers.image.revision=${{ github.sha }} \
            -t ${{ steps.prepare.outputs.baseref }} \
            --push .
      - name: docker build ratify with plugin
        run: |
          docker buildx create --use
          docker buildx build -f ./httpserver/Dockerfile \
            --attest type=sbom \
            --attest type=provenance,mode=max \
            --platform linux/amd64,linux/arm64,linux/arm/v7 \
            --build-arg build_sbom=true \
            --build-arg build_licensechecker=true \
            --build-arg build_schemavalidator=true \
            --build-arg build_vulnerabilityreport=true \
            --build-arg LDFLAGS="-X github.com/ratify-project/ratify/internal/version.Version=$TAG" \
            --label org.opencontainers.image.revision=${{ github.sha }} \
            -t ${{ steps.prepare.outputs.ref }} \
            --push .
      - name: clear
        if: always()
        run: |
          rm -f ${HOME}/.docker/config.json