build_synapse_release.yaml (1729B)
1 name: Publish Synapse Docker image on release 2 3 on: 4 push: 5 tags: 6 - synapse-** 7 paths: 8 - "synapse/**" 9 - ".github/workflows/build_synapse_release.yaml" 10 workflow_dispatch: 11 12 jobs: 13 push_to_registries: 14 permissions: 15 contents: read 16 packages: write 17 id-token: write 18 name: Push synapse image to repo 19 runs-on: ARM64 20 steps: 21 - name: Check out the repo 22 uses: actions/checkout@v3 23 with: 24 submodules: "recursive" 25 26 - name: Log in to Docker Hub 27 uses: docker/login-action@v2 28 with: 29 registry: coreharbor.kubernetes.midnightthoughts.space 30 username: ${{ secrets.DOCKER_USERNAME }} 31 password: ${{ secrets.DOCKER_PASSWORD }} 32 33 - name: Install Cosign 34 uses: sigstore/cosign-installer@v3 35 - name: Set up QEMU 36 uses: docker/setup-qemu-action@v2 37 - name: Set up Docker Buildx 38 uses: docker/setup-buildx-action@v2 39 40 - name: Docker meta 41 id: docker_meta 42 uses: docker/metadata-action@v4 43 with: 44 images: coreharbor.kubernetes.midnightthoughts.space/matrixdotorg/synapse 45 tags: type=sha,format=long 46 47 - name: Build and push 48 id: build_and_push 49 uses: docker/build-push-action@v4 50 with: 51 push: true 52 context: synapse 53 sbom: true 54 provenance: true 55 platforms: linux/amd64,linux/arm64 56 tags: ${{ steps.docker_meta.outputs.tags }} 57 - name: Sign the images with GitHub OIDC Token 58 env: 59 DIGEST: ${{ steps.build_and_push.outputs.digest }} 60 TAGS: ${{ steps.docker_meta.outputs.tags }} 61 run: cosign sign --yes "${TAGS}@${DIGEST}"