1+ name : Release
2+
3+ on :
4+ push :
5+ tags :
6+ - ' v*'
7+
8+ jobs :
9+ release :
10+ name : Release Container
11+ runs-on : ubuntu-latest
12+ permissions :
13+ contents : read
14+ packages : write
15+ id-token : write
16+ steps :
17+ - name : Checkout code
18+ uses : actions/checkout@v4
19+ with :
20+ fetch-depth : 0
21+
22+ - name : Set up Go
23+ uses : actions/setup-go@v5
24+ with :
25+ go-version-file : ' go.mod'
26+ cache : true
27+
28+ - name : Install Task
29+ uses : arduino/setup-task@v2
30+ with :
31+ version : ' 3.x'
32+ repo-token : ${{ secrets.GITHUB_TOKEN }}
33+
34+ - name : Install dependencies
35+ run : task install
36+
37+ - name : Test
38+ run : task test
39+
40+ - name : Setup Ko
41+ uses : ko-build/setup-ko@v0.9
42+
43+ - name : Log in to GitHub Container Registry
44+ uses : docker/login-action@v3
45+ with :
46+ registry : ghcr.io
47+ username : ${{ github.actor }}
48+ password : ${{ secrets.GITHUB_TOKEN }}
49+
50+ - name : Extract tag version
51+ id : tag
52+ run : echo "VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
53+
54+ - name : Set repository owner lowercase
55+ id : repo_owner
56+ run : echo "OWNER=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
57+
58+ - name : Build and push container
59+ env :
60+ KO_DOCKER_REPO : ghcr.io/${{ steps.repo_owner.outputs.OWNER }}/fetch
61+ VERSION : ${{ steps.tag.outputs.VERSION }}
62+ CREATION_TIME : $(date -u +'%Y-%m-%dT%H:%M:%SZ')
63+ run : |
64+ # Build and push the container with reproducible build flags
65+ ko build \
66+ --bare \
67+ --sbom=spdx \
68+ --platform=linux/amd64,linux/arm64 \
69+ --base-import-paths \
70+ --tags $VERSION,latest \
71+ ./cmd/server
72+
73+ - name : Install Cosign
74+ uses : sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
75+
76+ - name : Sign Image with Cosign
77+ env :
78+ KO_DOCKER_REPO : ghcr.io/${{ steps.repo_owner.outputs.OWNER }}/fetch
79+ run : |
80+ TAG=$(echo "${{ steps.tag.outputs.VERSION }}" | sed 's/+/_/g')
81+ # Sign the ko image
82+ cosign sign -y $KO_DOCKER_REPO/server:$TAG
83+
84+ # Sign the latest tag if building from a tag
85+ if [[ "${{ github.ref }}" == refs/tags/* ]]; then
86+ cosign sign -y $KO_DOCKER_REPO/server:latest
87+ fi
0 commit comments