diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 7bcdfec..df95e05 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -1,67 +1,51 @@ -name: Docker +name: Docker Build and Sign on: - schedule: - - cron: '26 20 * * *' push: - branches: [ "main" ] - tags: [ 'v*.*.*' ] - pull_request: - branches: [ "main" ] - -env: - REGISTRY: ghcr.io - IMAGE_NAME: ${{ github.repository }} + branches: + - main + workflow_dispatch: jobs: - build: + build-and-sign: runs-on: ubuntu-latest - permissions: - contents: read - packages: write - id-token: write steps: - - name: Checkout repository - uses: actions/checkout@v4 - - - name: Install cosign - uses: sigstore/cosign-installer@v2.1.2 - with: - cosign-release: 'v2.1.2' + - name: Checkout code + uses: actions/checkout@v3 - name: Set up Docker Buildx uses: docker/setup-buildx-action@v2 - - name: Log into registry + - name: Set up Docker + uses: docker/setup-docker-action@v2 + + - name: Build Docker image + run: | + docker build -t ghcr.io/willcaton2350/python-rumble-bot:main . + + - name: Log in to GitHub Container Registry uses: docker/login-action@v2 with: - registry: ${{ env.REGISTRY }} + registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - - name: Extract Docker metadata - id: meta - uses: docker/metadata-action@v5 + - name: Install Cosign + uses: sigstore/cosign-installer@v3.5.0 with: - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + cosign-release: 'v2.2.4' - - name: Build and push Docker image - id: build-and-push - uses: docker/build-push-action@v3 - with: - context: . - push: true - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha - cache-to: type=gha,mode=max - - - name: Write COSIGN_KEY to file - run: echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > cosign.key - - - name: Sign the published Docker image - if: github.event_name != 'pull_request' + - name: Sign image with Cosign + env: + COSIGN_KEY: ${{ secrets.COSIGN_KEY }} + TAGS: ghcr.io/willcaton2350/python-rumble-bot:main + DIGEST: sha256:a43b405e0ba8bfbd9ad479da6a4c927110fcfb12483b6655c0ac55b74166c95b run: | echo "Signing image with cosign..." - echo "${TAGS}" | xargs -I {} cosign sign --yes --key cosign.key {}@${DIGEST} + echo "${TAGS}" | xargs -I {} cosign sign --yes --key ${COSIGN_KEY} {}@${DIGEST} + + - name: Verify signature + run: | + echo "Verifying image signature with cosign..." + echo "${TAGS}" | xargs -I {} cosign verify --key ${COSIGN_KEY} {}@${DIGEST}