push-main.yaml

name: image

on:
  push:
    branches:
      - main

permissions:
  id-token: write
  packages: write
  security-events: write

jobs:
  ko:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
      - name: Set up Go
        uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
        with:
          go-version-file: backend/go.mod
          cache-dependency-path: backend/go.sum
      - name: Login
        uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Install Cosign
        uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2
      - name: Build assets
        run: |
          set -e
          make build-backend-assets
      - name: Publish image
        id: ko-publish
        run: |
          set -e
          echo "digest=$(VERSION=${{ github.ref_name }} make ko-publish)" >> $GITHUB_OUTPUT
      - name: Sign image
        run: |
          set -e
          cosign sign ${{ steps.ko-publish.outputs.digest }} --yes