release.yml

name: "CD -> Release"
on:
  workflow_dispatch:
    inputs:
      image-action:
        description: "Container image action"
        type: choice
        required: true
        default: "none"
        options:
          - "none"
          - "build"
          - "build-release"

concurrency:
  group: "${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  container:
    if: ${{ github.repository_owner == 'jspaste' && inputs.image-action != 'none' }}
    name: "Build container image"
    runs-on: ubuntu-latest
    env:
      REGISTRY: ghcr.io

    permissions:
      attestations: write
      id-token: write
      packages: write

    steps:
      - name: "Harden Runner"
        uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
        with:
          egress-policy: audit

      - name: "Setup QEMU"
        run: |
          sudo apt-get update
          sudo apt-get install -y qemu-user-static

      - name: "Setup tags"
        id: tags-image
        run: |
          TIMESTAMP="$(date +%Y.%m.%d)"
          GITHUB_SHA_SHORT="${GITHUB_SHA::7}"

          TAGS=()

          if [[ "${GITHUB_REF}" == "refs/heads/stable" ]]; then
            TAGS+=("latest")
          else
            TAGS+=("snapshot")
          fi

          TAGS+=("${GITHUB_SHA}")
          TAGS+=("${TIMESTAMP}-${GITHUB_SHA_SHORT}")

          echo "tags=${TAGS[*]}" >>"$GITHUB_OUTPUT"

      - name: "Checkout"
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
        with:
          persist-credentials: false

      - name: "Build image"
        id: build-image
        uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2.13
        with:
          archs: amd64, arm64
          containerfiles: Dockerfile
          image: ${{ github.repository }}
          layers: true
          oci: true
          tags: ${{ steps.tags-image.outputs.tags }}
          extra-args: --squash

      - if: ${{ inputs.image-action == 'build-release' }}
        name: "Login to GHCR"
        uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1.7
        with:
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
          registry: ${{ env.REGISTRY }}

      - if: ${{ inputs.image-action == 'build-release' }}
        name: "Push to GHCR"
        id: push-image
        uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2.8
        with:
          image: ${{ steps.build-image.outputs.image }}
          tags: ${{ steps.build-image.outputs.tags }}
          registry: ${{ env.REGISTRY }}

      - if: ${{ inputs.image-action == 'build-release' }}
        name: "Attest image"
        uses: actions/attest-build-provenance@173725a1209d09b31f9d30a3890cf2757ebbff0d # v1.1.2
        with:
          subject-name: "${{ env.REGISTRY }}/${{ steps.build-image.outputs.image }}"
          subject-digest: ${{ steps.push-image.outputs.digest }}
          push-to-registry: false