ci.yaml

name: ci

on:
  push:
    branches:
      - main
    paths:
      - .github/workflows/ci.yaml
      - apps/**/*.go

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        app: ["hello-world"]
    concurrency:
      group: ci
      cancel-in-progress: false
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v3.5.2
        with:
          fetch-depth: 1

      - name: Set outputs
        id: vars
        run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2

      - name: Install melange
        uses: chainguard-dev/actions/setup-melange@main

      - name: Install cosign
        uses: sigstore/cosign-installer@v3.5.0
        with:
          cosign-release: "v2.2.4"

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2.1.0
        with:
          registry: ${{ secrets.DOCKER_REGISTRY_URL }}
          username: ${{ secrets.DOCKER_REGISTRY_USER }}
          password: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}

      - name: Generate temporary signing key
        uses: chainguard-dev/actions/melange-keygen@main
        with:
          signing-key-path: ${{ github.workspace }}/melange.rsa

      - name: Build and package app
        uses: chainguard-dev/actions/melange-build-pkg@main
        with:
          workdir: apps/${{ matrix.app }}
          config: ${{ github.workspace }}/apps/${{ matrix.app }}/melange.yaml
          archs: x86_64,aarch64
          repository-path: ${{ github.workspace }}/packages
          sign-with-key: true
          signing-key-path: ${{ github.workspace }}/melange.rsa

      - id: apko
        name: Construct OCI image and publish
        uses: distroless/actions/apko-publish@main
        with:
          apko-image: ghcr.io/wolfi-dev/apko:latest
          config: ${{ github.workspace }}/apps/${{ matrix.app }}/apko.yaml
          keyring-append: ${{ github.workspace }}/melange.rsa.pub
          tag: ${{ secrets.DOCKER_REGISTRY_URL }}/${{ github.repository }}/${{ matrix.app }}:${{ steps.vars.outputs.sha_short }}
          generic-user: ${{ secrets.DOCKER_REGISTRY_USER }}
          generic-pass: ${{ secrets.DOCKER_REGISTRY_PASSWORD }}

      - name: Sign the images with GitHub OIDC Token
        run: |
          cosign sign --yes ${{ steps.apko.outputs.digest }}

  bump-version:
    runs-on: ubuntu-latest
    needs: build-and-push
    permissions:
      contents: write
    steps:
      - name: Checkout
        uses: actions/checkout@v3.5.2

      - name: Set outputs
        id: vars
        run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT

      - name: Bump version
        run: |
          sed -i 's|image: harbor.apko.do-2021.fr/do4-2022/openstack-k0s-apko/hello-world:[^ ]*|image: harbor.apko.do-2021.fr/do4-2022/openstack-k0s-apko/hello-world:${{ steps.vars.outputs.sha_short }}|' apps/hello-world/manifests/deployment.yaml

      - name: Commit version bump
        uses: stefanzweifel/git-auto-commit-action@v4
        with:
          commit_message: "build: bump release image to ${{ steps.vars.outputs.sha_short }}"
          commit_options: "-a --no-verify --signoff"
          commit_author: github-actions[bot] <github-actions[bot]@users.noreply.github.com>