release-image.yaml

name: Build and Push Images

on:
  push:
    tags:
      - "v*.*.*"

jobs:
  build-push:
    permissions:
      id-token: write # To be able to get OIDC ID token to sign images.
    runs-on: ubuntu-latest
    steps:
      - name: Get image version
        run: |
          echo "image_version=$(echo ${GITHUB_REF##*/v})" >> $GITHUB_ENV

      - name: Checkout code
        uses: actions/checkout@v3

      - name: Setup Go
        uses: actions/setup-go@v4
        with:
          go-version: 1.20.x

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3.0.3
        with:
          cosign-release: 'v1.13.1'
        
      - name: Compile
        run: make build

      - name: Build Docker Image
        run: VERSION=${{ env.image_version }} make docker

      - name: Sign Image
        env:
          VERSION: ${{ env.image_version }}
          COSIGN_EXPERIMENTAL: 1
          SIGN_IMAGE: 1
        run: make sign-image

      - name: Login to ghcr.io
        # This is where you will update the PAT to GITHUB_TOKEN
        run: echo "${{ secrets.GH_PAT }}" | docker login ghcr.io -u $ --password-stdin

      - name: Push Docker Image
        run: VERSION=${{ env.image_version }} make docker-push