-
Notifications
You must be signed in to change notification settings - Fork 0
37 lines (33 loc) · 1.25 KB
/
docker-image.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
name: Docker Image CI
on:
push:
branches: [ "main" ]
pull_request:
branches: [ "main" ]
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: cosign-installer
uses: sigstore/cosign-installer@v3.1.1
- name: build base image
id: build-base-image
uses: redhat-actions/buildah-build@v2
with:
image: fcos-signed
tags: latest
containerfiles: ./signed-fcos/Dockerfile
- name: push base image
id: push-base-image
uses: redhat-actions/push-to-registry@v2
with:
image: ${{ steps.build-base-image.outputs.image }}
tags: ${{ steps.build-base-image.outputs.tags }}
registry: ghcr.io/${{ github.repository_owner }}
username: ${{ github.repository_owner }}
password: ${{ secrets.GH_PAT }}
- name: cosign login (rh push-to-registry does not login)
run: cosign login ghcr.io -u ${{ github.repository_owner }} -p ${{ secrets.GH_PAT }}
- name: sign base container image with sigstore fulcio and github oidc
run: cosign sign --yes ghcr.io/${{ github.repository_owner }}/${{ steps.build-base-image.outputs.image }}@${{ steps.push-base-image.outputs.digest }}