build-publish.yml

name: 'Build Chainlink and Publish'

on:
  # Mimics old circleci behaviour
  push:
    tags:
      - 'v*'
    branches:
      - master
      - 'release/**'

jobs:
  build-sign-publish-chainlink:
    runs-on: ubuntu-20.04
    environment: build-publish
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0

      - name: Build, sign and publish chainlink image
        if: ! startsWith(github.ref_name, 'release/')
        uses: ./.github/actions/build-sign-publish-chainlink
        with:
          publish: true
          aws-role-to-assume: ${{ secrets.AWS_OIDC_IAM_ROLE_ARN }}
          aws-role-duration-seconds: ${{ secrets.AWS_ROLE_DURATION_SECONDS }}
          aws-region: ${{ secrets.AWS_REGION }}
          sign-images: true
          sign-method: 'keypair'
          cosign-private-key: ${{ secrets.COSIGN_PRIVATE_KEY }}
          cosign-public-key: ${{ secrets.COSIGN_PUBLIC_KEY }}
          cosign-password: ${{ secrets.COSIGN_PASSWORD }}
          verify-signature: true
      - name: Collect Metrics
        if: always()
        id: collect-gha-metrics
        uses: smartcontractkit/push-gha-metrics-action@808c183d1f5c26a4f3fd50b75d3cf7b58d9aa293
        with:
          basic-auth: ${{ secrets.GRAFANA_CLOUD_BASIC_AUTH }}
          hostname: ${{ secrets.GRAFANA_CLOUD_HOST }}
          this-job-name: build-sign-publish-chainlink
        continue-on-error: true