build-container.yaml

name: Build Container

on:
  repository_dispatch:
    types:
      - rebuild

  push:

jobs:
  build-container:
    name: Build Container Image
    runs-on: self-hosted
    environment: prod
    permissions:
      contents: read
      packages: write
      id-token: write # needed for signing the images with GitHub OIDC Token
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Free Disk Space (Ubuntu)
        uses: jlumbroso/free-disk-space@v1.3.1
        with:
          # this might remove tools that are actually needed,
          # if set to "true" but frees about 6 GB
          tool-cache: false
          
          # all of these default to true, but feel free to set to
          # "false" if necessary for your workflow
          android: true
          dotnet: true
          haskell: true
          large-packages: true
          docker-images: true
          swap-storage: true

      - name: Docker meta
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: |
            ghcr.io/${{ github.repository }}
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern=v{{version}}
            type=semver,pattern=v{{major}}.{{minor}}
            type=semver,pattern=v{{major}}.{{minor}}.{{patch}}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      
      - name: Auth with Vault
        env:
          VAULT_ADDR: ${{ secrets.VAULT_ADDR }}
        run: |
          vault write \
            -field=token \
            auth/approle/login \
            role_id=$(cat /home/runner/.vault-role) \
            secret_id=${{ secrets.VAULT_SECRET }} > .vault-token

      - name: Run scripts
        env:
          VAULT_ADDR: ${{ secrets.VAULT_ADDR }}
          VAULT_PATH: ${{ secrets.VAULT_PATH }}
          PREFIX: ${{ secrets.PREFIX }}
          DOMAIN: ${{ secrets.DOMAIN }}
          GHCR_AUTH: "${{ github.actor }}:${{ secrets.READ_PACKAGES }}"
          ROLE_ID: ${{ secrets.ROLE_ID }}
        run: |
          export VAULT_TOKEN=$(cat .vault-token)
          for script in set_perms update_files
          do
            chmod +x scripts/${script}/${script}.sh
            ./scripts/${script}/${script}.sh
          done

      - name: Buildah Build
        id: build-image
        uses: redhat-actions/buildah-build@v2
        with:
          containerfiles: Containerfile
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
      
      - name: Push image
        uses: redhat-actions/push-to-registry@v2
        with:
          image: ${{ steps.build-image.outputs.image }}
          tags: ${{ steps.build-image.outputs.tags }}
          username: ${{ github.actor }}
          password: ${{ github.token }}
  
      - name: Install Cosign
        uses: sigstore/cosign-installer@v3.5.0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Sign the images
        env:
          TAGS: ${{ steps.build-image.outputs.tags }}
          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
        run: |
          images=""
          digest=""
          for tag in ${TAGS}; do
            if [[ -z "${digest}" ]]
            then
              digest=$(cat $(echo ${tag} | tr '/:' '--')_digest.txt)
            fi
            images+="${tag}@${digest} "
          done
          cosign sign --key env://COSIGN_PRIVATE_KEY --yes ${images}