docker-release.yml

---
name: Docker Release

on:
  release:
    types: [published]

permissions: {}

jobs:
  docker-release:
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      # Required to checkout the code
      contents: read
      # Required to sign the Docker image
      id-token: write
    runs-on: ubuntu-latest
    steps:
      - name: Set IMAGE
        shell: bash
        run: |
          set -euo pipefail
          IFS=$'\n\t'	
          echo "IMAGE=${GITHUB_REPOSITORY#*/docker-}" >> "${GITHUB_ENV}"
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false
      - name: Set SOURCE_DATE_EPOCH
        run: |
          set -euo pipefail
          IFS=$'\n\t'	
          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "${GITHUB_ENV}"
      - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
      - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
        id: meta
        with:
          images: ${{ github.repository_owner }}/${{ env.IMAGE }}
          tags: |
            type=schedule
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=sha
      - uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        id: build
        with:
          # zizmor: ignore[template-injection] no user input
          context: ${{ env.IMAGE }}
          platforms: linux/amd64,linux/arm64
          pull: true
          push: true
          sbom: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
      - name: Install cosign
        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
      - name: Sign the Docker image
        working-directory: ${{ env.IMAGE }}
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
          TAGS: ${{ steps.meta.outputs.tags }}
        shell: bash
        run: |
          set -euo pipefail
          IFS=$'\n\t'
          images=()
          for tag in ${TAGS}; do
            images+=("${tag}@${DIGEST}")
          done
          cosign sign --recursive --yes "${images[@]}"
      - name: Manually generate release note
        shell: bash
        run: |
          set -euo pipefail
          IFS=$'\n\t'
          echo "This failure is expected. It is a reminder to update the release notes for this newly created release."
          echo "To do so, go to ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/releases/latest and click on the edit button."
          echo "Then click on the 'Generate release notes' button and finally the 'Update release' button. Cheers!"
          exit 1