docker_fuzz_login.yml (3131B)
1 name: Docker fuzz_login 2 on: 3 push: 4 branches: ["main"] 5 6 env: 7 # Use docker.io for Docker Hub if empty 8 REGISTRY: ghcr.io 9 # github.repository as <account>/<repo> 10 IMAGE_NAME: ${{ github.repository }} 11 12 jobs: 13 build: 14 runs-on: ubuntu-latest 15 permissions: 16 contents: read 17 packages: write 18 # This is used to complete the identity challenge 19 # with sigstore/fulcio when running outside of PRs. 20 id-token: write 21 22 steps: 23 - name: Checkout repository 24 uses: actions/checkout@v3 25 26 # Install the cosign tool except on PR 27 # https://github.com/sigstore/cosign-installer 28 - name: Install cosign 29 if: github.event_name != 'pull_request' 30 uses: sigstore/cosign-installer@7e0881f8fe90b25e305bbf0309761e9314607e25 31 with: 32 cosign-release: "v1.9.0" 33 34 # Workaround: https://github.com/docker/build-push-action/issues/461 35 - name: Setup Docker buildx 36 uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf 37 38 # Login against a Docker registry except on PR 39 # https://github.com/docker/login-action 40 - name: Log into registry ${{ env.REGISTRY }} 41 if: github.event_name != 'pull_request' 42 uses: docker/login-action@28218f9b04b4f3f62068d7b6ce6ca5b26e35336c 43 with: 44 registry: ${{ env.REGISTRY }} 45 username: ${{ github.actor }} 46 password: ${{ secrets.GITHUB_TOKEN }} 47 48 # Extract metadata (tags, labels) for Docker 49 # https://github.com/docker/metadata-action 50 - name: Extract Docker metadata 51 id: meta 52 uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38 53 with: 54 images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} 55 tags: type=raw,value=fuzz_login 56 57 # Build and push Docker image with Buildx (don't push on PR) 58 # https://github.com/docker/build-push-action 59 - name: Build and push Docker image 60 id: build-and-push 61 uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a 62 with: 63 context: . 64 push: ${{ github.event_name != 'pull_request' }} 65 tags: ${{ steps.meta.outputs.tags }} 66 labels: ${{ steps.meta.outputs.labels }} 67 cache-from: type=gha 68 cache-to: type=gha,mode=max 69 file: ./dockerfiles/fuzz_login 70 71 # Sign the resulting Docker image digest except on PRs. 72 # This will only write to the public Rekor transparency log when the Docker 73 # repository is public to avoid leaking data. If you would like to publish 74 # transparency data even for private images, pass --force to cosign below. 75 # https://github.com/sigstore/cosign 76 - name: Sign the published Docker image 77 if: ${{ github.event_name != 'pull_request' }} 78 env: 79 COSIGN_EXPERIMENTAL: "true" 80 # This step uses the identity token to provision an ephemeral certificate 81 # against the sigstore community Fulcio instance. 82 run: echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign sign {}@${{ steps.build-and-push.outputs.digest }}