canfar/.github/workflows/release.yml at main · opencadc/canfar · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
name: Publish CANFAR to Container Registries

on:
  repository_dispatch:
    types: [release-build]

env:
  GHCR_REGISTRY: ghcr.io
  IMAGE_NAME: opencadc/canfar
  IMAGE_TAG_LATEST: latest
  IMAGE_TAG_RELEASE: ${{ github.event.client_payload.tag_name }}

permissions:
  contents: read

jobs:
  release-build:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      packages: write # Upload package to ghcr.io
      attestations: write # Attest the build provenance
      id-token: write # Genereate OIDC token for attestations
    steps:
      - name: Harden Runner
        timeout-minutes: 10
        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
        with:
          egress-policy: audit

      -
        name: Client Payload
        timeout-minutes: 10
        run: |
          echo "Client Payload: ${{ toJson(github.event.client_payload) }}"
      -
        name: Checkout Code
        timeout-minutes: 10
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
        with:
          ref: ${{ github.event.client_payload.tag_name }}
      -
        name: Setup Docker Buildx
        timeout-minutes: 10
        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
        with:
          install: true
      -
        name: Perform GHCR Login
        timeout-minutes: 10
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      -
        name: Build & Push Docker Image
        timeout-minutes: 10
        id: build
        uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
        with:
          context: .
          target: production
          file: Dockerfile
          platforms: linux/amd64,linux/arm64
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: mode=max
          sbom: true
          push: true
          labels: |
            org.opencontainers.image.title=canfar
            org.opencontainers.image.version=${{ env.IMAGE_TAG_RELEASE }}
            org.opencontainers.image.description='Python Client for CANFAR Science Portal'
            org.opencontainers.image.licenses=AGPL-3.0
            org.opencontainers.image.source=https://github.com/opencadc/canfar
          tags: |
            ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG_RELEASE }}
            ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG_LATEST }}
      -
        name: Attest GHCR Container Image
        timeout-minutes: 10
        uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1.4.4
        with:
          subject-name: ${{ env.GHCR_REGISTRY }}/${{ env.IMAGE_NAME }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true