release.yaml

name: release

on:
  push:
    tags: ["v*"]

permissions:
  contents: read
  packages: write
  id-token: write
  attestations: write

env:
  GHCR_IMAGE: ghcr.io/codebenderhq/pds
  ACR_IMAGE: worklynsocialbb1c59.azurecr.io/pds

jobs:
  image:
    runs-on: self-hosted
    steps:
      - name: Check out signed tag
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
      - name: Require GitHub-verified annotated tag
        env:
          GH_TOKEN: ${{ github.token }}
          TAG: ${{ github.ref_name }}
        run: |
          object_type=$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${TAG}" --jq .object.type)
          object_sha=$(gh api "repos/${GITHUB_REPOSITORY}/git/ref/tags/${TAG}" --jq .object.sha)
          test "$object_type" = tag
          verified=$(gh api "repos/${GITHUB_REPOSITORY}/git/tags/${object_sha}" --jq .verification.verified)
          reason=$(gh api "repos/${GITHUB_REPOSITORY}/git/tags/${object_sha}" --jq .verification.reason)
          test "$verified" = true || { echo "Tag signature is not verified: $reason" >&2; exit 1; }
      - name: Set up Buildx
        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - name: Log in to GHCR
        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}
      - name: Log in to Azure ACR with the runner managed identity
        shell: bash
        run: |
          aad_token="$(curl --fail --silent --show-error -H Metadata:true \
            'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2019-08-01&resource=https%3A%2F%2Fmanagement.azure.com%2F' \
            | jq -r .access_token)"
          refresh_token="$(curl --fail --silent --show-error -X POST \
            -H 'Content-Type: application/x-www-form-urlencoded' \
            --data-urlencode grant_type=access_token \
            --data-urlencode service=worklynsocialbb1c59.azurecr.io \
            --data-urlencode tenant=e36a9888-2f11-4f96-91ac-3e395f8984e2 \
            --data-urlencode access_token="$aad_token" \
            https://worklynsocialbb1c59.azurecr.io/oauth2/exchange | jq -r .refresh_token)"
          test -n "$refresh_token" && test "$refresh_token" != null
          printf '%s' "$refresh_token" | docker login worklynsocialbb1c59.azurecr.io \
            --username 00000000-0000-0000-0000-000000000000 --password-stdin
      - name: Generate image metadata
        id: meta
        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
        with:
          images: |
            ${{ env.GHCR_IMAGE }}
            ${{ env.ACR_IMAGE }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,format=long
      - name: Build and push image
        id: build
        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .
          push: true
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - name: Generate SPDX SBOM
        uses: anchore/sbom-action@f8bdd1d8ac5e901a77a92f111440fdb1b593736b # v0.20.6
        with:
          image: ${{ env.GHCR_IMAGE }}@${{ steps.build.outputs.digest }}
          format: spdx-json
          output-file: sbom.spdx.json
          upload-artifact: false
      - name: Upload SBOM
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: sbom-${{ github.ref_name }}
          path: sbom.spdx.json
          if-no-files-found: error
      - name: Attest build provenance
        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
        with:
          subject-name: ${{ env.GHCR_IMAGE }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true
      - name: Install Cosign
        uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
      - name: Sign image and attach SBOM attestation
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
        run: |
          for image in "$GHCR_IMAGE" "$ACR_IMAGE"; do
            cosign sign --yes "${image}@${DIGEST}"
            cosign attest --yes --type spdxjson --predicate sbom.spdx.json "${image}@${DIGEST}"
          done