build.yaml

name: Build docker image and push to Artifact Registry

on:
  push:
    branches:
      - master
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v4
      - name: Authenticate to Google Cloud
        id: auth
        uses: google-github-actions/auth@v1
        with:
          token_format: access_token
          workload_identity_provider: "projects/${{ secrets.GOOGLE_PROJECT_ID }}/locations/global/workloadIdentityPools/${{ secrets.GOOGLE_WID_POOL_ID }}/providers/${{ secrets.GOOGLE_WID_PROVIDER_ID }}"
          service_account: ${{ secrets.GOOGLE_SA_EMAIL }}
      - name: Login to GCR
        uses: docker/login-action@v3
        with:
          registry: gcr.io
          username: oauth2accesstoken
          password: ${{ steps.auth.outputs.access_token }}
      - name: Create Tag
        id: create-tag
        run: echo 'tag=${github.sha:0:7}' >> $GITHUB_OUTPUT
      - name: Build and push
        uses: docker/build-push-action@v2
        with:
          context: .
          push: true
          tags: |
            user/app:${{ steps.create-tag.outputs.tag }}
            user/app:latest