release-job-image.yml

name: Release Job-Image

on:
  workflow_call:
    inputs:
      branch:
        required: false
        default: main
        type: string
      version:
        required: true
        type: string
      docker-tags:
        required: false
        type: string
        default: ""
      docker-platforms:
        required: false
        default: linux/amd64
        type: string
      cosign-repository:
        required: false
        default: ""
        type: string
      job-image:
        required: true
        default: ""
        type: string
    secrets:
      token:
        required: true
      pat:
        required: true
      ghcr-password:
        required: false

jobs:
  release-job-image:
    permissions:
      id-token: write
      contents: write
      packages: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@6d193bf28034eafb982f37bd894289fe649468fc
        with:
          fetch-depth: 0
          token: ${{ secrets.pat }}

      - name: Setup Cosign
        uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382

      - name: Setup Syft
        uses: ckotzbauer/actions-toolkit/setup-syft@0.46.0

      - name: Build and push image
        uses: ckotzbauer/actions-toolkit/docker@0.46.0
        with:
          ghcr-password: ${{ secrets.ghcr-password }}
          dockerhub-user: ${{ secrets.dockerhub-user }}
          dockerhub-password: ${{ secrets.dockerhub-password }}
          context: job-images/${{ inputs.job-image }}
          push: true
          sign: true
          verify: true
          cosign-repository: ${{ inputs.cosign-repository }}
          platforms: ${{ inputs.docker-platforms }}
          tags: ${{ inputs.docker-tags }}

      - name: Generate SBOM
        uses: ckotzbauer/actions-toolkit/sbom@0.46.0
        with:
          images: ${{ inputs.docker-tags }}
          sign: true
          verify: true
          attest: true
          cosign-repository: ${{ inputs.cosign-repository }}