build.yml

name: build

on:
  push:
    branches:
      - main

  pull_request:
  merge_group:

  schedule:
    - cron: '0 2 * * *'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
  cancel-in-progress: true

env:
  DRY_RUN: ${{ github.ref != 'refs/heads/main' }}
  HUSKY: 0
  SKOPEO_VERSION: 1.16.1 # renovate: datasource=github-releases depName=skopeo packageName=visualon/skopeo-prebuild versioning=semver

permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - run: corepack enable
      - run: pnpm install
      - run: pnpm prettier

  build:
    needs:
      - lint
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      packages: write

    strategy:
      fail-fast: false
      matrix:
        tag:
          - 20.04
          - 22.04
          - 24.04
          - latest

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0

      - name: install skopeo v${{ env.SKOPEO_VERSION }}
        run: |
          tmp_dir="$(mktemp -d)"
          curl -sSLf "https://github.com/visualon/skopeo-prebuild/releases/download/${{ env.SKOPEO_VERSION }}/skopeo-${{ env.SKOPEO_VERSION }}-x86_64.tar.xz" -o "${tmp_dir}/skopeo.tar.xz"
          tar --strip 2 -xf "${tmp_dir}/skopeo.tar.xz"
          ls -la .

      - name: Docker registry login
        if: env.DRY_RUN == 'false'
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin

      - name: Publish ${{matrix.tag}} to ghcr.io
        if: env.DRY_RUN == 'false'
        run: |
          ./skopeo copy --multi-arch all --digestfile=digest.txt docker://docker.io/library/ubuntu:${{matrix.tag}} docker://ghcr.io/${{ github.repository }}:${{matrix.tag}}
          cosign sign -y "ghcr.io/${{ github.repository }}@$(cat digest.txt)"