image.yml

name: Build and Publish Image
on:
    push:
      branches: [ "main" ]
      paths:
          - Dockerfile
          - requirements.txt
    workflow_dispatch:

env:
  BUILDX_NO_DEFAULT_ATTESTATIONS: 1 # Disable provenance

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
        attestations: write # To create and write attestations
        contents: read
        id-token: write # Additional permissions for the persistence of attestations
        packages: write # To push to GHCR

    steps:
     - name: Checkout repository
       uses: actions/checkout@v4

     - name: Generate image name
       run: |
         REPO_OWNER_LOWERCASE="$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')"
         echo "REPO_OWNER_LOWERCASE=$REPO_OWNER_LOWERCASE" >> "$GITHUB_ENV"
         echo "IMAGE_NAME=ghcr.io/$REPO_OWNER_LOWERCASE/dl-lab" >> "$GITHUB_ENV"
 
     - name: Generate Docker Meta tags
       id: docker_meta
       uses: docker/metadata-action@v5
       with:
         images: |
           ${{ env. IMAGE_NAME }}
         tags: |
           type=semver,pattern={{version}}
           type=semver,pattern={{major}}.{{minor}}
           type=semver,pattern={{raw}}
           type=semver,pattern=v{{major}}
           type=ref,event=branch
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
 
     - name: Login to GitHub Container Registry
       uses: docker/login-action@v3
       with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
   
     - name: Build and push image
       id: push
       uses: docker/build-push-action@v6
       with:
         context: .
         file: Containerfile
         push: true
         tags: ${{ steps.docker_meta.outputs.tags }}
         labels: ${{ steps.docker_meta.outputs.labels }}
         platforms: linux/amd64
         cache-from: type=gha
         cache-to: type=gha,mode=max
         provenance: false
     
     - uses: sigstore/cosign-installer@v3.6.0

    #  - name: Sign container image
    #    if: github.repository == 'kbdharun/DL-Lab'
    #    run: |
    #      cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ env. IMAGE_NAME }}:${{ steps.docker_meta.outputs.tags }}
    #    env:
    #      COSIGN_EXPERIMENTAL: false
    #      COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
 
     - name: Attest pushed image
       uses: actions/attest-build-provenance@v1
       id: attest
       with:
         subject-name: ${{ env.IMAGE_NAME }}
         subject-digest: ${{ steps.push.outputs.digest }}
         push-to-registry: false