Build_And_Publish_Docker_Images.yml

name: Build and publish Docker images

on:
  push:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read
  packages: write

env:
  IMAGE_NAME: enalean/bz2tuleap

jobs:
  build:
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v4
      - name: Build image
        run: docker build -t ${{ env.IMAGE_NAME }} --label revision=${{ github.sha }} --label workflow_run_id=${{ github.run_id }} .
      - name: Install Cosign
        uses: sigstore/cosign-installer@v3.5.0
      - name: Log into Docker Hub
        run: echo "${{ secrets.DOCKER_HUB_TOKEN }}" | docker login -u bz2tuleappushbot --password-stdin
      - name: Publish image
        run: docker push ${{ env.IMAGE_NAME }}
      - name: Sign image
        env:
          VAULT_ADDR: ${{ secrets.VAULT_ADDR }}
        run: |
          export VAULT_TOKEN=$(curl "$VAULT_ADDR"/v1/auth/approle/login --silent --fail -X POST --data '{"role_id": "${{ secrets.VAULT_ROLE_ID_SIGNING }}", "secret_id": "${{ secrets.VAULT_SECRET_ID_SIGNING }}"}' | jq -r '.auth.client_token')
          cosign sign --yes --tlog-upload=true --key hashivault://tuleap-additional-tools-signing "$(docker inspect --format='{{index .RepoDigests 0}}' ${{ env.IMAGE_NAME }})"