release.yml

name: Create and publish a api image

on: push

env:
  REGISTRY: ghcr.io/metal-toolbox
  APP_IMAGE_NAME: audito-maldito/audito-maldito

jobs:
  auto-release:
    name: Create Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Release
        uses: softprops/action-gh-release@v1
        with:
          generate_release_notes: true

  build-and-push-image:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Log in to the Container registry
        uses: docker/login-action@1f401f745bf57e30b3a2800ad308a87d2ebdf14b
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: sigstore/cosign-installer@main

      - name: Get current date
        id: date
        run: echo "::set-output name=date::$(date -u +'%Y-%m-%dT%H:%M:%SZ')"

      - name: Extract metadata (tags, labels) for Docker
        id: meta-api
        uses: docker/metadata-action@62339db73c56dd749060f65a6ebb93a6e056b755
        with:
          images: ${{ env.REGISTRY }}/${{ env.APP_IMAGE_NAME }}

      - name: Build rsyslog and push Docker image
        id: rsyslog-build-push
        uses: docker/build-push-action@v5.1.0
        with:
          context: "./contrib/rsyslog"
          push: true
          file: ./contrib/rsyslog/Dockerfile.ubuntu
          tags: ${{ env.REGISTRY }}/${{ env.APP_IMAGE_NAME }}:${{ github.ref_name }}-rsyslog
          labels: ${{ steps.meta-api.outputs.labels }}

      - name: Get rsyslog container info
        id: rsyslog-image-info
        run: |
          image_digest="$(docker inspect "${{ env.REGISTRY }}/${{ env.APP_IMAGE_NAME }}:${{ github.ref_name }}-rsyslog" --format '{{ index .RepoDigests 0 }}' | awk -F '@' '{ print $2 }')"
          echo "::set-output name=image-digest::${image_digest}"

      - run: (env | grep TARGET_IMAGE) && cosign sign -y -r ${TARGET_IMAGE}
        env:
          TARGET_IMAGE: ${{ steps.rsyslog-image-info.outputs.image-digest }}

      - name: Build and push Docker image
        id: am-build-push
        uses: docker/build-push-action@v5.1.0
        with:
          push: true
          file: Dockerfile
          tags: ${{ env.REGISTRY }}/${{ env.APP_IMAGE_NAME }}:${{ github.ref_name }}
          labels: ${{ steps.meta-api.outputs.labels }}

      - name: Get am container info
        id: am-image-info
        run: |
          image_digest="$(docker inspect "${{ env.REGISTRY }}/${{ env.APP_IMAGE_NAME }}:${{ github.ref_name }}" --format '{{ index .RepoDigests 0 }}' | awk -F '@' '{ print $2 }')"
          echo "::set-output name=image-digest::${image_digest}"

      - run: cosign sign -y -r ${TARGET_IMAGE}
        env:
          TARGET_IMAGE: ${{ steps.am-image-info.outputs.image-digest }}