release.yml

name: Release

on:
  push:
    tags:
      - "*"

jobs:
  container:
    timeout-minutes: 720
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      # This is used to complete the identity challenge
      # with sigstore/fulcio when running outside of PRs.
      id-token: write
      deployments: write
    strategy:
      fail-fast: true
      matrix:
        containerfile:
          - path: "Containerfile.codespaces"
            name: "codespaces"
          - path: "Containerfile.gitpod"
            name: "gitpod"
    steps:
      - name: Checkout repository and submodules
        uses: actions/checkout@v4
        with:
          submodules: recursive
      - name: Process version of the tag
        id: version
        uses: ncipollo/semantic-version-action@v1
      
      # Install the cosign tool except on PR
      # https://github.com/sigstore/cosign-installer
      - name: Install cosign
        uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382
        with:
          cosign-release: 'v1.7.1'

      - uses: chrnorm/deployment-action@v2
        name: Create GitHub deployment
        id: deployment
        with:
          token: "${{ github.token }}"
          log-url: https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}
          environment: container-image-${{ matrix.containerfile.name }}
      
      # Login against a container registry
      - name: Log into registry ghcr.io
        uses: redhat-actions/podman-login@v1
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Update deployment status (in_progress)
        if: success()
        uses: chrnorm/deployment-status@v2
        with:
          token: '${{ github.token }}'
          environment-url: ${{ steps.deployment.outputs.environment_url }}
          deployment-id: ${{ steps.deployment.outputs.deployment_id }}
          state: 'in_progress'

      - name: Buildah Action
        id: build-image
        uses: redhat-actions/buildah-build@v2
        with:
          containerfiles: |
            ${{ matrix.containerfile.path }}
          platforms: linux/amd64,linux/arm64
          image: ghcr.io/${{ github.repository }}
          tags: ${{ steps.version.outputs.tag }}-${{ matrix.containerfile.name }}

      - name: Push container image
        id: push-container-image
        uses: redhat-actions/push-to-registry@v2
        with:
          image: ${{ steps.build-image.outputs.image }}
          tags: ${{ steps.build-image.outputs.tags }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Sign the resulting Docker image digest except on PRs.
      # This will only write to the public Rekor transparency log when the Docker
      # repository is public to avoid leaking data.  If you would like to publish
      # transparency data even for private images, pass --force to cosign below.
      # https://github.com/sigstore/cosign
      - name: Sign the published Docker image
        env:
          COSIGN_EXPERIMENTAL: "true"
        # This step uses the identity token to provision an ephemeral certificate
        # against the sigstore community Fulcio instance.
        run: cosign sign ghcr.io/${{ github.repository }}@${{ steps.build-and-push.outputs.digest }}

      - name: Update deployment status (success)
        if: success()
        uses: chrnorm/deployment-status@v2
        with:
          token: '${{ github.token }}'
          environment-url: ${{ steps.deployment.outputs.environment_url }}
          deployment-id: ${{ steps.deployment.outputs.deployment_id }}
          state: 'success'

      - name: Update deployment status (failure)
        if: failure()
        uses: chrnorm/deployment-status@v2
        with:
          token: '${{ github.token }}'
          environment-url: ${{ steps.deployment.outputs.environment_url }}
          deployment-id: ${{ steps.deployment.outputs.deployment_id }}
          state: 'failure'