-
Notifications
You must be signed in to change notification settings - Fork 398
38 lines (34 loc) · 1.17 KB
/
image.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
name: image
on:
push:
branches:
- 'main'
workflow_dispatch:
permissions:
contents: read
packages: write
id-token: write
jobs:
image:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
- uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
with:
go-version-file: 'go.mod'
check-latest: true
- uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
# Build ko from HEAD, build and push an image tagged with the commit SHA,
# then keylessly sign it with cosign.
- name: Publish and sign image
env:
KO_DOCKER_REPO: ghcr.io/${{ github.repository }}
run: |
go build ./
echo "${{ github.token }}" | ./ko login ghcr.io --username "${{ github.actor }}" --password-stdin
img=$(./ko build --bare --platform=all -t latest -t ${{ github.sha }} ./)
echo "built ${img}"
cosign sign ${img} --yes \
-a sha=${{ github.sha }} \
-a run_id=${{ github.run_id }} \
-a run_attempt=${{ github.run_attempt }}