name: Docker Build and Publish on: push: branches: ["new"] workflow_dispatch: env: REGISTRY: ghcr.io IMAGE_NAME: ${{ github.repository }} jobs: build: runs-on: ubuntu-latest permissions: contents: read packages: write id-token: write steps: - name: Checkout code uses: actions/checkout@v3 - name: Setup Docker layer caching uses: satackey/action-docker-layer-caching@v0.0.11 continue-on-error: true - name: Setup build environment uses: docker/setup-qemu-action@v3 - name: Setup Buildx uses: docker/setup-buildx-action@v3.2.0 - name: Login to registry uses: docker/login-action@v3.1.0 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Extract metadata id: meta uses: docker/metadata-action@v5.5.1 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - name: Get version id: get_version run: echo "version=$(git describe --tags --always)" >> $GITHUB_OUTPUT - name: Build and push id: build-and-push uses: docker/build-push-action@v5.3.0 with: context: . push: true platforms: linux/amd64,linux/arm64 tags: | ${{ env.REGISTRY }}/${{ github.repository_owner }}/xboard:new ${{ env.REGISTRY }}/${{ github.repository_owner }}/xboard:${{ steps.get_version.outputs.version }} - name: Install cosign uses: sigstore/cosign-installer@v3.4.0 with: cosign-release: 'v2.2.2' - name: Sign image env: TAGS: ${{ steps.meta.outputs.tags }} DIGEST: ${{ steps.build-and-push.outputs.digest }} run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}