cd.release.build.yml

name: "CD: Release Build"

on:
  repository_dispatch:
    types: [release-build]

env:
  REGISTRY: images.opencadc.org
  IMAGE: platform/skaha
  TAG: latest
  TAG_RELEASE: ${{ github.event.client_payload.tag_name }}

jobs:
  release-build:
    if: github.repository == 'opencadc/science-platform'
    runs-on: ubuntu-latest
    permissions:
      attestations: write
      id-token: write
    steps:
      -
        name: Client Payload
        id: client-payload
        run: |
          echo "Client Payload: ${{ toJson(github.event.client_payload) }}"
      -
        name: Checkout
        uses: actions/checkout@v3
      -
        name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v3.7.1
        with:
          install: true
      -
        name: Perform Container Registry Login
        uses: docker/login-action@v3.3.0
        with:
          registry: images.opencadc.org
          username: ${{ secrets.SKAHA_REGISTRY_USERNAME }}
          password: ${{ secrets.SKAHA_REGISTRY_TOKEN }}
      -
        name: Build and Push Docker Image
        id: build
        uses: docker/build-push-action@v6.9.0
        with:
          context: skaha/
          target: production
          file: skaha/Dockerfile
          platforms: linux/amd64
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: mode=max
          sbom: true
          push: true
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ env.TAG }}
            ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ env.TAG_RELEASE }}
          labels: |
            org.opencontainers.image.title=skaha
            org.opencontainers.image.version=${{ env.TAG_RELEASE }}
            org.opencontainers.image.description="Science Platform Backend"
            org.opencontainers.image.licenses=AGPL-3.0
            org.opencontainers.image.url=https://github.com/opencadc/science-platform
      -
        # See https://github.com/marketplace/actions/attest-build-provenance#container-image
        # for more information on the attest-build-provenance action
        name: Attest Container Image
        id: attest
        uses: actions/attest-build-provenance@v1.4.4
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE }}
          subject-digest: ${{ steps.build.outputs.digest }}
          # Currently not pushing attestations to Harbor Registry
          # push-to-registry: true
          show-summary: true
      -
        name: Install Cosign
        id: install-cosign
        uses: sigstore/cosign-installer@v3.7.0
        with:
          cosign-release: 'v2.4.1'
      -
        name: Cosign Container Image
        id: cosign
        run: |
          cosign version
          cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ env.TAG }} --upload
          cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ env.TAG_RELEASE }} --upload
          cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ steps.build.outputs.digest }} --upload