name: build on: workflow_dispatch: push: branches: - main # Ignore Markdown files paths-ignore: - '**.md' schedule: # Build the image regularly (each Friday) - cron: '13 21 * * 5' env: REGISTRY: ghcr.io IMAGE_NAME: wonderfall/synapse jobs: build: name: Build, scan & push runs-on: "ubuntu-latest" permissions: contents: read packages: write id-token: write steps: - name: Checkout code uses: actions/checkout@v2 - name: Extract version for tags run: | echo "FULL_VERSION=$(grep -oP '(?<=SYNAPSE_VERSION=).*' Dockerfile | head -c6)" >> $GITHUB_ENV echo "MAJOR_VERSION=$(grep -oP '(?<=SYNAPSE_VERSION=).*' Dockerfile | head -c4)" >> $GITHUB_ENV - name: Install cosign if: github.event_name != 'pull_request' uses: sigstore/cosign-installer@main with: cosign-release: 'v1.13.1' - name: Set up Docker Buildx uses: docker/setup-buildx-action@v2 - name: Login to registry if: github.event_name != 'pull_request' uses: docker/login-action@v2 with: registry: ${{ env.REGISTRY }} username: ${{ github.repository_owner }} password: ${{ secrets.GITHUB_TOKEN }} - name: Set Docker metadata id: meta uses: docker/metadata-action@v4 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | latest ${{ env.FULL_VERSION }} ${{ env.MAJOR_VERSION }} - name: Build and push Docker image id: build-and-push uses: docker/build-push-action@v3 with: context: . push: ${{ github.event_name != 'pull_request' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} - name: Sign the published Docker image if: ${{ github.event_name != 'pull_request' }} run: cosign sign ${TAGS} env: COSIGN_EXPERIMENTAL: "true" TAGS: ${{ steps.meta.outputs.tags }}