docker.yaml

name: Build/Publish Docker Image

permissions: read-all

env:
  PLATFORMS: linux/amd64,linux/arm64

on:
  release:
    types:
      - published
  push:
    branches:
      - main
    tags:
      - v*
    paths-ignore:
      - "docs/**"
      - "**/*.md"
  pull_request:
    paths-ignore:
      - "docs/**"
      - "**/*.md"
    types: [labeled, unlabeled, opened, synchronize, reopened]

jobs:
  buildAndPush:
    strategy:
      matrix:
        image:
          - name: dependency-controller
            target: controller
          - name: dependency-webhook
            target: webhook
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    name: Build and Publish Docker Image
    if: |
      github.event_name == 'push' ||
      (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'ok-to-image')) ||
      (github.event_name == 'release' && github.event.action == 'published')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        id: meta
        with:
          images: |
            ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=ref,event=branch
            type=ref,event=tag
            type=ref,event=pr
            type=sha
          flavor: |
            latest=${{ github.ref == 'refs/heads/main' }}
      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
        with:
          platforms: arm64
      - name: Set up Docker Buildx
        timeout-minutes: 5
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
      - name: Login to GHCR
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push
        id: image
        timeout-minutes: 20
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          platforms: ${{ env.PLATFORMS }}
          push: true
          # BuildKit attaches one SBOM attestation per platform, which is what
          # a multi-arch image needs. actions/attest can only ever name a
          # single subject-digest, so it would have to pair one architecture's
          # SBOM with the shared index digest.
          sbom: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          target: ${{ matrix.image.target }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
      - name: Sign image with cosign
        env:
          COSIGN_EXPERIMENTAL: "1"
          TAGS: ${{ steps.meta.outputs.tags }}
          GH_REPO: ${{ github.repository }}
          GH_WORKFLOW: ${{ github.workflow }}
          GH_SHA: ${{ github.sha }}
          IMAGE_DIGEST: ${{ steps.image.outputs.digest }}
        run: |
          mapfile -t TAG_LIST <<< "$TAGS"
          for tag in "${TAG_LIST[@]}"; do
            cosign sign \
              -a "repo=${GH_REPO}" \
              -a "workflow=${GH_WORKFLOW}" \
              -a "sha=${GH_SHA}" \
              --yes \
              "${tag}@${IMAGE_DIGEST}"
          done
      - name: Install syft
        id: syft
        uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
      # Release assets, not attestations: the registry gets BuildKit's SPDX
      # attestation per platform, the release gets CycloneDX files that the
      # OCM pipeline can embed. syft resolves the index to the runner's own
      # platform unless told otherwise, so ask for each one explicitly.
      - name: Generate per-architecture SBOMs
        env:
          SYFT: ${{ steps.syft.outputs.cmd }}
          IMAGE: ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }}
          DIGEST: ${{ steps.image.outputs.digest }}
          NAME: ${{ matrix.image.name }}
        run: |
          set -euo pipefail
          mkdir -p sboms
          for p in ${PLATFORMS//,/ }; do
            "$SYFT" scan --platform "$p" "${IMAGE}@${DIGEST}" \
              -o "cyclonedx-json=sboms/${NAME}-${p//\//-}.cyclonedx.json"
          done
      - name: Attest provenance
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-name: ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }}
          subject-digest: ${{ steps.image.outputs.digest }}
          push-to-registry: true
          create-storage-record: false
      - name: Sign SBOMs
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
        run: |
          set -euo pipefail
          # The .sigstore.json suffix is what OpenSSF Scorecard's
          # Signed-Releases check looks for.
          for f in sboms/*.cyclonedx.json; do
            cosign sign-blob --yes --new-bundle-format=true \
              --bundle "${f}.sigstore.json" "$f"
          done
      - name: Upload SBOMs for the release job
        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: sboms-${{ matrix.image.name }}
          path: sboms/
          retention-days: 1

  # Immutable releases forbid uploading assets to an already-published release,
  # so the SBOMs are attached while the release is still a draft. Publishing it
  # stays a deliberate manual step (UI, or `gh release edit <tag> --draft=false`).
  release:
    name: Attach SBOMs to draft release
    needs: buildAndPush
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download SBOMs from the image jobs
        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
        with:
          pattern: sboms-*
          merge-multiple: true
          path: sboms
      - name: Create draft release with SBOMs attached
        env:
          GH_TOKEN: ${{ github.token }}
          # No checkout in this job, so gh cannot infer the repository.
          GH_REPO: ${{ github.repository }}
          TAG: ${{ github.ref_name }}
        run: |
          set -euo pipefail
          # Re-runs land on an existing draft; uploading to one is still
          # allowed, only published releases are immutable.
          if gh release view "$TAG" >/dev/null 2>&1; then
            gh release upload "$TAG" sboms/* --clobber
          else
            gh release create "$TAG" sboms/* --draft --generate-notes
          fi