name: Docker

on:
  push:
    branches: [ 'main' ]
    tags: [ 'v*' ]
  pull_request:
    # Run the workflow on pull_request events to ensure we can still build the image.
    # We only publish the image on push events (see if statements in steps below).
    branches: [ 'main' ]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build-and-push-image:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write

    steps:
    - uses: actions/checkout@v3

    - name: Setup Docker buildx
      uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # v2.2.1
      with:
        # use buildx v0.9.1 (https://community.fly.io/t/10171/26)
        version: v0.9.1

    - name: Log into registry ${{ env.REGISTRY }}
      uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
      if: github.event_name == 'push'
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Extract Docker metadata
      id: meta
      uses: docker/metadata-action@57396166ad8aefe6098280995947635806a0e6ea # v4.1.1
      with:
        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

    - name: Build and push Docker image
      id: build-and-push
      uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5 # v3.2.0
      with:
        context: .
        push: ${{ github.event_name == 'push' }}
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        platforms: linux/amd64,linux/arm64,linux/arm/v7

    # Sign the Docker image
    - name: Install cosign
      if: github.event_name == 'push'
      uses: sigstore/cosign-installer@9becc617647dfa20ae7b1151972e9b3a2c338a2b #v2.8.1
    - name: Sign the published Docker image
      if: github.event_name == 'push'
      env:
        COSIGN_EXPERIMENTAL: "true"
      run: cosign sign ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }}