package.yml

name: Release

on:
  push:
    tags:
      - v**
env:
  REGISTRY: ghcr.io/${{ github.repository_owner }}/trivy-extractor
  API_IMAGE_NAME: trivy-extractor
  Version: ${{ github.ref_name }}

jobs:
  build-and-push-image:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3

      - name: Log in to the Container registry
        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          ref: ${{ github.ref_name }}

      - name: Get current date
        id: date
        run: echo "::set-output name=date::$(date -u +'%Y-%m-%dT%H:%M:%SZ')"

      - name: Extract metadata (tags, labels) for Docker
        id: meta-api
        uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175
        with:
          images: ${{ env.REGISTRY }}/${{ env.API_IMAGE_NAME }}

      - name: Build and push Docker image
        uses: docker/build-push-action@2eb1c1961a95fc15694676618e422e8ba1d63825
        with:
          push: true
          file: Dockerfile
          tags: ${{ env.REGISTRY }}/${{ env.API_IMAGE_NAME }}:${{ env.Version}}
          labels: ${{ steps.meta-api.outputs.labels }}

    outputs:
      tags: ${{ steps.meta-api.outputs.tags }}

  sign:
    needs: build-and-push-image
    runs-on: ubuntu-latest
    permissions:
      packages: write
      id-token: write

    steps:
      - name: Log in to the Container registry
        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
          ref: ${{ github.ref_name }}

      - uses: sigstore/cosign-installer@main

      - run: cosign sign -y -r ${TAGS}
        env:
          TAGS: ${{needs.build-and-push-image.outputs.tags}}