mysql.yml

# This workflow will do a clean installation of node dependencies, cache/restore them, build the source code and run tests across different versions of node
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions

name: mysql image

on:
  workflow_dispatch:
    inputs:
      version:
        description: The version of the Docker image to use.
        type: string
        required: true
        default: 1.0.0

env:
  # Use docker.io for Docker Hub if empty
  REGISTRY: ghcr.io
  # github.repository as <account>/<repo>
  IMAGE_NAME: liubin/mysql
  USER_NAME: liubin95
  CONTEXT: mysql

permissions:
  contents: read
  packages: write
  # needed for signing the images with GitHub OIDC Token **not production ready**
  id-token: write

jobs:

  docker:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Install cosign
        uses: sigstore/cosign-installer@v3

      - name: Setup Docker buildx
        uses: docker/setup-buildx-action@v2
        with:
          driver-opts: image=moby/buildkit:buildx-stable-1

      - name: Log into registry ${{ env.REGISTRY }}
        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ env.USER_NAME }}
          password: ${{ secrets.GITHUB_TOKEN  }}

      - name: Extract Docker metadata
        id: meta
        uses: docker/metadata-action@v4
        with:
          images: ${{ env.REGISTRY }}/${{ env.USER_NAME }}/${{ env.IMAGE_NAME }}
          flavor: |
            latest=auto
          tags: |
            type=semver,pattern={{version}},value=${{ inputs.version }}

      - name: Build and push Docker image
        id: build-and-push
        uses: docker/build-push-action@v3
        with:
          context: ${{env.CONTEXT}}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Sign the images with GitHub OIDC Token
        run: echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign sign --yes {}@${{ steps.build-and-push.outputs.digest }}