joplin/.github/workflows/docker-publish.yml at 3a556532d84f99e2a7f3399748128a68a50c6374 · Containerpak/joplin · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
name: Publish

on:
  push:
    branches: [main]
  schedule:
    - cron: '42 5 * * 2'
  workflow_dispatch:

permissions:
  contents: read
  packages: write
  attestations: write
  id-token: write

concurrency:
  group: publish-joplin-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f
      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051
        with:
          images: ghcr.io/containerpak/joplin
          tags: |
            type=raw,value=main
            type=sha,prefix=sha-
      - id: build
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8
        with:
          context: .
          file: Containerfile
          platforms: linux/amd64
          push: true
          pull: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          provenance: mode=max
          sbom: true
      - name: Verify package
        run: docker run --rm ghcr.io/containerpak/joplin:main sh -c 'test -x /usr/bin/joplin && test -f /usr/share/applications/joplin.desktop'
      - name: Publish summary
        run: echo "ghcr.io/containerpak/joplin@${{ steps.build.outputs.digest }}" >> "$GITHUB_STEP_SUMMARY"

      - uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62

      - name: Install cpak-sign
        run: |
          curl -fsSLO https://github.com/Containerpak/cpak/releases/latest/download/cpak-sign-linux-amd64
          install -Dm755 cpak-sign-linux-amd64 /usr/local/bin/cpak-sign

      - name: Sign the package state
        env:
          CPAK_REGISTRY_USERNAME: ${{ github.actor }}
          CPAK_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
        run: |
          repository="$(printf '%s' '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')"
          cpak-sign state \
            --origin "github.com/${repository}" \
            --image "ghcr.io/${repository}:main" \
            --generation "${{ github.run_number }}"
          cosign sign-blob --yes --new-bundle-format=true \
            --bundle cpak-state.sigstore.json cpak-state
          cpak-sign attach --image "ghcr.io/${repository}"