1+ name : Release 
2+ 
3+ on :
4+   push :
5+     tags :
6+       - ' v*' 
7+ 
8+ jobs :
9+   release :
10+     name : Release Container 
11+     runs-on : ubuntu-latest 
12+     permissions :
13+       contents : read 
14+       packages : write 
15+       id-token : write 
16+     steps :
17+       - name : Checkout code 
18+         uses : actions/checkout@v4 
19+         with :
20+           fetch-depth : 0 
21+ 
22+       - name : Set up Go 
23+         uses : actions/setup-go@v5 
24+         with :
25+           go-version-file : ' go.mod' 
26+           cache : true 
27+ 
28+       - name : Install Task 
29+         uses : arduino/setup-task@v2 
30+         with :
31+           version : ' 3.x' 
32+           repo-token : ${{ secrets.GITHUB_TOKEN }} 
33+ 
34+       - name : Install dependencies 
35+         run : task install 
36+ 
37+       - name : Test 
38+         run : task test 
39+ 
40+       - name : Setup Ko 
41+ 42+ 
43+       - name : Log in to GitHub Container Registry 
44+         uses : docker/login-action@v3 
45+         with :
46+           registry : ghcr.io 
47+           username : ${{ github.actor }} 
48+           password : ${{ secrets.GITHUB_TOKEN }} 
49+ 
50+       - name : Extract tag version 
51+         id : tag 
52+         run : echo "VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT 
53+ 
54+       - name : Set repository owner lowercase 
55+         id : repo_owner 
56+         run : echo "OWNER=$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT 
57+ 
58+       - name : Build and push container 
59+         env :
60+           KO_DOCKER_REPO : ghcr.io/${{ steps.repo_owner.outputs.OWNER }}/fetch 
61+           VERSION : ${{ steps.tag.outputs.VERSION }} 
62+           CREATION_TIME : $(date -u +'%Y-%m-%dT%H:%M:%SZ') 
63+         run : | 
64+           # Build and push the container with reproducible build flags 
65+           ko build \ 
66+             --bare \ 
67+             --sbom=spdx \ 
68+             --platform=linux/amd64,linux/arm64 \ 
69+             --base-import-paths \ 
70+             --tags $VERSION,latest \ 
71+             ./cmd/server 
72+ 
73+ name : Install Cosign 
74+         uses : sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb  #  v3.8.2
75+ 
76+       - name : Sign Image with Cosign 
77+         env :
78+           KO_DOCKER_REPO : ghcr.io/${{ steps.repo_owner.outputs.OWNER }}/fetch 
79+         run : | 
80+           TAG=$(echo "${{ steps.tag.outputs.VERSION }}" | sed 's/+/_/g') 
81+           # Sign the ko image 
82+           cosign sign -y $KO_DOCKER_REPO/server:$TAG 
83+ 
84+           # Sign the latest tag if building from a tag 
85+           if [[ "${{ github.ref }}" == refs/tags/* ]]; then 
86+             cosign sign -y $KO_DOCKER_REPO/server:latest 
87+           fi 
0 commit comments