docker-build.yml

name: Docker container release

on:
  workflow_call:
    secrets:
      docker_username:
        required: true
      docker_token:
        required: true
      nexus_username:
        required: true
      nexus_token:
        required: true
      sysdig_token:
        required: true
      kms_gcp_project:
        required: false
      gcp_wif:
        required: false
      cosign_key:
        required: false

jobs:
  release-docker:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: write
      packages: write
      id-token: write
    steps:
    - name: Checkout Repository
      uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
      with:
        show-progress: false
    - name: Download Build Artifacts
      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
      with:
        name: build
        path: dist
    - name: Docker Login to DockerHub
      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
      with:
        username: ${{ secrets.docker_username }}
        password: ${{ secrets.docker_token }}
    - name: Login to Mia registry
      uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
      with:
        registry: nexus.mia-platform.eu
        username: ${{ secrets.nexus_username }}
        password: ${{ secrets.nexus_token }}
    - name: Install Cosign
      uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
    - name: Set up QEMU
      uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
      with:
        platforms: amd64,arm64
    - name: Configure docker metadata
      id: meta
      uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
      env:
        DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
      with:
        images: |
          docker.io/microlc/middleware
          nexus.mia-platform.eu/microlc/middleware
        tags: |
          type=raw,value=latest,enable={{is_default_branch}}
          type=semver,pattern={{version}}
        labels: |
          org.opencontainers.image.documentation=https://micro-lc.io/
          org.opencontainers.image.vendor=Mia s.r.l.
        annotations: |
          org.opencontainers.image.documentation=https://micro-lc.io/
          org.opencontainers.image.vendor=Mia s.r.l.
    - name: Setup Buildx Context
      uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
      id: buildx
      with:
        platforms: linux/amd64,linux/arm64
    - name: Build Docker Image
      id: docker-build
      uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
      with:
        context: .
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        annotations: ${{ steps.meta.output.annotations }}
        platforms: ${{ steps.buildx.outputs.platforms }}
        cache-from: type=gha
        cache-to: type=gha,mode=max
    - name: Scan image
      uses: sysdiglabs/scan-action@0065d3b93bd4115371b55720251adb1d228fe188 # v5.1.1
      with:
        image-tag: nexus.mia-platform.eu/microlc/middleware:${{ steps.meta.output.version.main }}
        sysdig-secure-url: "https://eu1.app.sysdig.com"
        sysdig-secure-token: ${{ secrets.sysdig_token }}
        registry-user: ${{ secrets.nexus_username }}
        registry-password: ${{ secrets.nexus_token }}
        stop-on-processing-error: true
    - name: Generate SBOM
      uses: anchore/sbom-action@f5e124a5e5e1d497a692818ae907d3c45829d033 # v0.17.3
      if: github.ref_type == 'tag'
      with:
        artifact-name: middleware-sbom.spdx.json
        output-file: ./middleware-sbom.spdx.json
        image: nexus.mia-platform.eu/microlc/middleware:${{ steps.meta.output.version.main }}
        upload-release-assets: true
    - name: GCP Auth
      uses: google-github-actions/auth@8254fb75a33b976a221574d287e93919e6a36f70 # v2.1.6
      if: github.ref_type == 'tag'
      with:
        project_id: ${{ secrets.kms_gcp_project }}
        workload_identity_provider: ${{ secrets.gcp_wif }}
        create_credentials_file: true
    - name: Sign image with a key
      if: github.ref_type == 'tag'
      run: |
        for tag in ${TAGS}; do
          image="${tag}@${DIGEST}"
          cosign sign --recursive --yes --key "${COSIGN_PRIVATE_KEY}" "${image}"
          cosign attest --recursive --yes --key "${COSIGN_PRIVATE_KEY}" --predicate "middleware-sbom.spdx.json" --type="spdxjson" "${image}"
        done
      env:
        TAGS: |
          docker.io/microlc/middleware:${{ steps.meta.output.version.main }}
          nexus.mia-platform.eu/microlc/middleware:${{ steps.meta.output.version.main }}
        DIGEST: ${{ steps.docker-build.outputs.digest }}
        COSIGN_PRIVATE_KEY: ${{ secrets.cosign_key }}