publish.yaml

name: publish
on:
  workflow_dispatch:
  push:
    branches:
      - 'release-*'
      - 'master'
      - 'main'
    tags:
      - 'v*'
      - '!pkg*'
env:
  REGISTRY: ghcr.io

jobs:
  publish:
    name: Publish container images
    permissions:
      id-token: write  # needed to sign images with cosign.
      packages: write  # needed to push images to ghcr.io.
    runs-on: ubuntu-latest
    strategy: 
      fail-fast: false
      matrix:
          include:
          -
            name: modelxd
            image: kubeservice-stack/modelxd
            file: ./hack/build/Dockerfile
            platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x
          -
            name: modelxdl
            image: kubeservice-stack/modelxdl
            file: ./hack/build/Dockerfile.dl
            platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - id: git-branch
        run: |
          echo "git-branch=$(echo ${GITHUB_REF##*/} | tr '[A-Z]' '[a-z]')" >> "$GITHUB_OUTPUT"
      - name: Import environment variables from file
        run: cat ".github/env" >> $GITHUB_ENV
      - name: Install Go
        uses: actions/setup-go@v5
        with:
          go-version: '${{ env.golang-version }}'
          check-latest: true
      - name: Install cosign
        uses: sigstore/cosign-installer@main
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v2 
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2
      - name: Check the cosign version
        run: cosign version
      - name: Install crane
        uses: imjasonh/setup-crane@v0.4
      - name: Login to ghcr.io
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Cosign login
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | cosign login -u ${{ github.repository_owner }} --password-stdin ghcr.io
      - name: Build images and push
        uses: docker/build-push-action@v3
        with:
          file: ${{ matrix.file }}
          platforms: ${{ matrix.platforms }}
          push: true
          build-args: |
            BUILDKIT_CONTEXT_KEEP_GIT_DIR=1
          tags: |
            ${{ env.REGISTRY }}/${{ matrix.image }}:${{steps.git-branch.outputs.git-branch}}
      - name: Test ${{ matrix.name }}
        run: |
          docker pull ${{ env.REGISTRY }}/${{ matrix.image}}:${{steps.git-branch.outputs.git-branch}}
          docker image inspect ${{ env.REGISTRY }}/${{ matrix.image}}:${{steps.git-branch.outputs.git-branch}}