build-app.yaml

name: build-flask-app

on:
  workflow_dispatch
  # push:
  #   branches: [ main ]
  # pull_request:
  #   branches: [ main ]

env:
  BASE_IMAGE_REGISTRY: ${{ vars.BASE_IMAGE_REGISTRY }}
  BASE_IMAGE_REPO: ${{ vars.BASE_IMAGE_REPO }}
  BASE_IMAGE_TAG: ${{ vars.BASE_IMAGE_TAG }}
  BASE_IMAGE_DIGEST: ${{ vars.BASE_IMAGE_DIGEST }}
  NOTATION_EXPERIMENTAL: 1
  TARGET_IMAGE_REGISTRY: ${{ vars.TARGET_IMAGE_REGISTRY }}
  TARGET_IMAGE_REPO: flaskapp
  TARGET_IMAGE_TAG: ${{ vars.TARGET_IMAGE_TAG }}
  SIGNING_KEY_ID: ${{ vars.SIGNING_KEY_ID }}

jobs:
  verify-base-image:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Display environment
        run: |
          echo "BASE_IMAGE_REGISTRY: $BASE_IMAGE_REGISTRY"
          echo "BASE_IMAGE_REPO: $BASE_IMAGE_REPO"
          echo "BASE_IMAGE_TAG: $BASE_IMAGE_TAG"
          echo "BASE_IMAGE_DIGEST: $BASE_IMAGE_DIGEST"
          echo "NOTATION_EXPERIMENTAL: $NOTATION_EXPERIMENTAL"
          echo "TARGET_IMAGE_REGISTRY: $TARGET_IMAGE_REGISTRY"
          echo "TARGET_IMAGE_REPO: $TARGET_IMAGE_REPO"
          echo "TARGET_IMAGE_TAG: $TARGET_IMAGE_TAG"
          echo "SIGNING_KEY_ID: $SIGNING_KEY_ID"
      - name: Checkout the code
        uses: actions/checkout@v4
      - name: Setup Notation CLI
        uses: notaryproject/notation-action/setup@v1
        with:
          version: "1.0.0"
      - name: Setup ORAS CLI
        uses: oras-project/setup-oras@v1
        with:
          version: "1.0.0"
      - name: Sign into Azure
        uses: Azure/login@v1
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
      - name: Sign into ACR
        run: |
            az acr login --name ${{ env.BASE_IMAGE_REGISTRY }}
      - name: Verify base image signature
        uses: notaryproject/notation-action/verify@v1
        with:
          target_artifact_reference: "${{ env.BASE_IMAGE_REGISTRY }}/${{ env.BASE_IMAGE_REPO }}:${{ env.BASE_IMAGE_TAG }}"
          trust_policy: ".github/trustpolicy/build-stage/trustpolicy.json"
          trust_store: ".github/truststore"
          allow_referrers_api: "true"
      - name: Verify the image is not end-of-life
        run: |
            stages/build/src/verify-image-lifecycle.sh ${{ env.BASE_IMAGE_REGISTRY }} ${{ env.BASE_IMAGE_REPO }} ${{ env.BASE_IMAGE_TAG }} ${{ env.BASE_IMAGE_DIGEST }}
      - name: Verify the image has no vulnerabilities
        run: |
            stages/build/src/verify-vulnerability-status.sh ${{ env.BASE_IMAGE_REGISTRY }} ${{ env.BASE_IMAGE_REPO }} ${{ env.BASE_IMAGE_TAG }} ${{ env.BASE_IMAGE_DIGEST }}

  build-flask-app:
    needs: verify-base-image
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - name: Display environment
        run: |
          echo "BASE_IMAGE_REGISTRY: $BASE_IMAGE_REGISTRY"
          echo "BASE_IMAGE_REPO: $BASE_IMAGE_REPO"
          echo "BASE_IMAGE_TAG: $BASE_IMAGE_TAG"
          echo "BASE_IMAGE_DIGEST: $BASE_IMAGE_DIGEST"
          echo "NOTATION_EXPERIMENTAL: $NOTATION_EXPERIMENTAL"
          echo "TARGET_IMAGE_REGISTRY: $TARGET_IMAGE_REGISTRY"
          echo "TARGET_IMAGE_REPO: $TARGET_IMAGE_REPO"
          echo "TARGET_IMAGE_TAG: $TARGET_IMAGE_TAG"
          echo "SIGNING_KEY_ID: $SIGNING_KEY_ID"
      - name: Checkout the code
        uses: actions/checkout@v4
      - name: Setup Notation CLI
        uses: notaryproject/notation-action/setup@v1
        with:
          version: "1.0.0"
      - name: Sign into Azure
        uses: Azure/login@v1
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
      - name: Sign into ACR
        run: |
            az acr login --name ${{ env.BASE_IMAGE_REGISTRY }}
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Build and push the Flask app image
        uses: docker/build-push-action@v5
        with:
          context: ./sample
          push: true
          tags: ${{ env.TARGET_IMAGE_REGISTRY }}/${{ env.TARGET_IMAGE_REPO }}:${{ env.TARGET_IMAGE_TAG }}
          build-args: |
            BASE_IMAGE=${{ env.BASE_IMAGE_REGISTRY }}/${{ env.BASE_IMAGE_REPO }}:${{ env.BASE_IMAGE_TAG }}
      - name: Sign the image with notation-azure-kv plugin
        uses: notaryproject/notation-action/sign@v1
        with:
          plugin_name: azure-kv
          plugin_url: https://github.com/Azure/notation-azure-kv/releases/download/v1.0.1/notation-azure-kv_1.0.1_linux_amd64.tar.gz
          plugin_checksum: f8a75d9234db90069d9eb5660e5374820edf36d710bd063f4ef81e7063d3810b
          key_id: ${{ env.SIGNING_KEY_ID }}
          target_artifact_reference: ${{ env.TARGET_IMAGE_REGISTRY }}/${{ env.TARGET_IMAGE_REPO }}:${{ env.TARGET_IMAGE_TAG }}
          signature_format: cose