github-packages.yml

---
name: Publish Container image to GH Packages

on:
  pull_request:
    branches: [master]
    paths-ignore:
      - '*.md'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref_name }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  gh_container_registry:
    name: Push Docker image to GitHub Packages
    runs-on: ubuntu-latest
    permissions:
      packages: write
      contents: read
      id-token: write # needed for signing the images with GitHub OIDC Token
      attestations: write
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0

      - name: Install cosign
        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        id: docker_build
        uses: docker/build-push-action@67a2d409c0a876cbe6b11854e3e25193efe4e62d # v6.12.0
        with:
          context: .
          push: true
          sbom: true
          tags: ghcr.io/${{ github.repository }}/ghcr-test:${{ github.sha }}

      - name: Sign the images with GitHub OIDC Token
        env:
          DIGEST: ${{ steps.docker_build.outputs.digest }}
          TAGS: ghcr.io/${{ github.repository }}/ghcr-test
        run: cosign sign --yes "${TAGS}@${DIGEST}"

      - name: Attest
        uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb  # v2.1.0
        id: attest
        with:
          subject-name: ghcr.io/${{ github.repository }}/ghcr-test
          subject-digest: ${{ steps.docker_build.outputs.digest }}
          push-to-registry: true

      - name: Run Snyk to check Docker image for vulnerabilities
        continue-on-error: true
        uses: snyk/actions/docker@b98d498629f1c368650224d6d212bf7dfa89e4bf #v0.4.0
        env:
          # In order to use the Snyk Action you will need to have a Snyk API token.
          # More details in https://github.com/snyk/actions#getting-your-snyk-token
          # or you can signup for free at https://snyk.io/login
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          image: ghcr.io/${{ github.repository }}/ghcr-test:${{ github.sha }}
          args: --file=Dockerfile

      - name: Upload result to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@0b21cf2492b6b02c465a3e5d7c473717ad7721ba # v3.23.1
        with:
          sarif_file: snyk.sarif

      - name: Image digest
        run: echo ${{ steps.docker_build.outputs.digest }}