build-publish.yml

name: 'Build Chainlink and Publish'

on:
  # Mimics old circleci behaviour
  push:
    tags:
      - 'v*'
    branches:
      - master

jobs:
  build-sign-publish-chainlink:
    runs-on: ubuntu-20.04
    environment: build-publish
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Collect Metrics
        id: collect-gha-metrics
        uses: smartcontractkit/push-gha-metrics-action@v1
        with:
          basic-auth: ${{ secrets.GRAFANA_CLOUD_BASIC_AUTH }}
          hostname: ${{ secrets.GRAFANA_CLOUD_HOST }}
          this-job-name: build-sign-publish-chainlink
        continue-on-error: true

      - name: Checkout repository
        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0

      - name: Build, sign and publish chainlink image
        uses: ./.github/actions/build-sign-publish-chainlink
        with:
          publish: true
          aws-role-to-assume: ${{ secrets.AWS_OIDC_IAM_ROLE_ARN }}
          aws-role-duration-seconds: ${{ secrets.AWS_ROLE_DURATION_SECONDS }}
          aws-region: ${{ secrets.AWS_REGION }}
          sign-images: true
          sign-method: 'keypair'
          cosign-private-key: ${{ secrets.COSIGN_PRIVATE_KEY }}
          cosign-public-key: ${{ secrets.COSIGN_PUBLIC_KEY }}
          cosign-password: ${{ secrets.COSIGN_PASSWORD }}
          verify-signature: true