d-publish-image.yaml

name: d-publish-image
on:
  workflow_call:
    inputs:
      client:
        description: 'client name'
        required: true
        type: string
      image_tag:
        description: 'image tag'
        required: true
        type: string
      image_name:
        description: 'image registry and name'
        required: true
        type: string
      cosign:
        required: false
        default: false
        type: boolean
        description: 'run cosign on released image'
      support_platforms:
        required: false
        default: true
        type: boolean
        description: 'support amd64/arm64'
jobs:
  check-secret:
    name: check if QUAYIO_REGISTRY_USERNAME & QUAYIO_REGISTRY_PASSWORD is set in github secrets
    runs-on: ubuntu-latest
    outputs:
      is-secret-set: ${{ steps.check-secret-set.outputs.is-secret-set }}
    steps:
      - name: check if QUAYIO_REGISTRY_USERNAME & QUAYIO_REGISTRY_PASSWORD is set in github secrets
        id: check-secret-set
        env:
          QUAYIO_REGISTRY_USERNAME: ${{ secrets.QUAYIO_REGISTRY_USERNAME }}
          QUAYIO_REGISTRY_PASSWORD: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }}
        run: |
          echo "is-secret-set=${{ env.QUAYIO_REGISTRY_USERNAME != '' && env.QUAYIO_REGISTRY_PASSWORD != '' }}" >> $GITHUB_OUTPUT
  build-image:
    needs: [check-secret]
    if: needs.check-secret.outputs.is-secret-set == 'true'
    name: Build image and upload to registry
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # ratchet:actions/checkout@v3
        with:
          submodules: recursive
      - name: Set up QEMU
        uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # ratchet:docker/setup-qemu-action@v2
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@f03ac48505955848960e80bbb68046aa35c7b9e7 # ratchet:docker/setup-buildx-action@v2
      - name: Login to Quay.io
        env:
          QUAY_PASSWORD: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }}
          QUAY_USERNAME: ${{ secrets.QUAYIO_REGISTRY_USERNAME }}
        run: docker login -u="${QUAY_USERNAME}" -p="${QUAY_PASSWORD}" quay.io
      - name: Build and push image
        if: ${{ inputs.support_platforms }}
        run: docker buildx build . --file build/Dockerfile --tag ${{ inputs.image_name }}:${{ inputs.image_tag }} --tag ${{ inputs.image_name }}:latest --build-arg image_version=${{ inputs.image_tag }} --build-arg client=${{ inputs.client }} --push --platform linux/amd64,linux/arm64
      - name: Build and push image without amd64/arm64 support
        if: ${{ !inputs.support_platforms }}
        run: docker buildx build . --file build/Dockerfile --tag ${{ inputs.image_name }}:${{ inputs.image_tag }} --tag ${{ inputs.image_name }}:latest --build-arg image_version=${{ inputs.image_tag }} --build-arg client=${{ inputs.client }} --push
      - name: Install cosign
        uses: sigstore/cosign-installer@4079ad3567a89f68395480299c77e40170430341 # ratchet:sigstore/cosign-installer@main
        with:
          cosign-release: 'v1.12.0'
      - name: sign kubescape container image
        if: ${{ inputs.cosign }}
        env:
          COSIGN_EXPERIMENTAL: "true"
        run: |
          cosign sign --force ${{ inputs.image_name }}