Build container #58
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build container | |
| on: | |
| workflow_dispatch: # build on demand | |
| release: | |
| types: [published] # build on release | |
| schedule: | |
| - cron: "45 4 * * 3" # 4:45am on Wednesday UTC | |
| jobs: | |
| build-jekyll: | |
| runs-on: ubuntu-latest # use the GitHub hosted runners | |
| permissions: | |
| packages: write # for uploading the finished container | |
| security-events: write # for github/codeql-action/upload-sarif to upload SARIF results | |
| id-token: write # to complete the identity challenge with sigstore/fulcio when running outside of PRs | |
| attestations: write # to create the attestations for the container | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Set Docker metadata | |
| id: docker_meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ghcr.io/some-natalie/jekyll-in-a-can | |
| tags: | | |
| type=sha,format=long | |
| type=raw,value=latest | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| registry: ghcr.io | |
| - name: Build and push the container | |
| id: build-and-push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| file: ./Dockerfile | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ghcr.io/some-natalie/jekyll-in-a-can:latest | |
| annotations: ${{ steps.docker_meta.outputs.annotations }} | |
| - name: Attest the build | |
| uses: actions/attest-build-provenance@v2 | |
| id: attest | |
| with: | |
| subject-name: ghcr.io/some-natalie/jekyll-in-a-can | |
| subject-digest: ${{ steps.build-and-push.outputs.digest }} | |
| push-to-registry: true | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@main | |
| - name: Sign the images with GitHub OIDC Token | |
| env: | |
| DIGEST: ${{ steps.build-and-push.outputs.digest }} | |
| TAGS: ${{ steps.docker_meta.outputs.tags }} | |
| run: | | |
| images="" | |
| for tag in ${TAGS}; do | |
| images+="${tag}@${DIGEST} " | |
| done | |
| cosign sign --yes ${images} |