33  push :
44    tags :
55      - ' v*' 
6-   workflow_dispatch :
7-     inputs :
8-       tag :
9-         description : ' image tag prefix' 
10-         required : true 
116
127permissions :
138  contents : write  #  needed to write releases
149  id-token : write  #  needed for keyless signing
1510  packages : write  #  needed for ghcr access
1611
17- env :
18-   APP : ${{ github.event.repository.name }} 
19- 
2012jobs :
2113  build :
2214    name : Build 
2315    runs-on : ubuntu-latest 
2416    steps :
2517      - name : Checkout code 
26-         uses : actions/checkout@v2 
27- 28-         with :
29-           go-version : ' 1.17' 
30-       - name : Prepare 
31-         id : prep 
32-         run : | 
33-           VERSION="${{ github.event.inputs.tag }}-${GITHUB_SHA::8}" 
34-           if [[ $GITHUB_REF == refs/tags/* ]]; then 
35-             VERSION=${GITHUB_REF/refs\/tags\//} 
36-           fi 
37-           echo ::set-output name=BUILD_DATE::$(date -u +'%Y-%m-%dT%H:%M:%SZ') 
38-           echo ::set-output name=VERSION::${VERSION} 
39- name : Setup QEMU 
40-         uses : docker/setup-qemu-action@v1 
41-         with :
42-           platforms : all 
43-       - name : Setup Docker Buildx 
44-         id : buildx 
45-         uses : docker/setup-buildx-action@v1 
18+         uses : actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8  # v3
19+       - uses : actions/setup-go@c4a742cab115ed795e34d4513e2cf7d472deb55f  # v3.3.1
4620        with :
47-           buildkitd-flags :  " --debug " 
48-       - name : Login to GitHub Container Registry 
49-         uses : docker/login-action@v1  
21+           go-version :  ' 1.18 ' 
22+       - name : Docker Login 
23+         uses : docker/login-action@v2  
5024        with :
5125          registry : ghcr.io 
5226          username : ${{ github.actor }} 
5327          password : ${{ secrets.GITHUB_TOKEN }} 
54-       - name : Generate images meta 
55-         id : meta 
56-         uses : docker/metadata-action@v3 
57-         with :
58-           images : | 
59-             ghcr.io/raffis/${{ env.APP }} 
60- tags : | 
61-             type=raw,value=${{ steps.prep.outputs.VERSION }} 
62- name : Publish multi-arch container image 
63-         uses : docker/build-push-action@v2 
64-         with :
65-           push : true 
66-           builder : ${{ steps.buildx.outputs.name }} 
67-           context : . 
68-           file : ./Dockerfile 
69-           platforms : linux/amd64,linux/arm/v7,linux/arm64 
70-           tags : ${{ steps.meta.outputs.tags }} 
71-           labels : ${{ steps.meta.outputs.labels }} 
72-       - name : Check images 
73-         run : | 
74-           docker buildx imagetools inspect ghcr.io/raffis/${{ env.APP }}:${{ steps.prep.outputs.VERSION }} 
75-           docker pull ghcr.io/raffis/${{ env.APP }}:${{ steps.prep.outputs.VERSION }} 
76- name : Generate release manifests 
77-         if : startsWith(github.ref, 'refs/tags/v') 
78-         run : | 
79-           mkdir -p deploy/release 
80-           kustomize build ./deploy/exporter > ./deploy/release/${{ env.APP }}.deployment.yaml 
81-           echo '[CHANGELOG](https://github.com/raffis/${{ env.APP }}/blob/master/CHANGELOG.md)' > ./deploy/release/notes.md 
82- uses : anchore/sbom-action/download-syft@v0 
28+       - name : Setup Cosign 
29+         uses : sigstore/cosign-installer@9becc617647dfa20ae7b1151972e9b3a2c338a2b  # v2.8.1
30+       - uses : anchore/sbom-action/download-syft@06e109483e6aa305a2b2395eabae554e51530e1d  # v0.13.1
8331      - name : Create release and SBOM 
8432        if : startsWith(github.ref, 'refs/tags/v') 
85-         uses : goreleaser/goreleaser-action@v2  
33+         uses : goreleaser/goreleaser-action@b508e2e3ef3b19d4e4146d4f8fb3ba9db644a757   # v3.2.0 
8634        with :
8735          version : latest 
88-           args : release --release-notes=deploy/release/notes.md -- rm-dist --skip-validate 
36+           args : release --rm-dist --skip-validate 
8937        env :
9038          GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }} 
39+           REPO_TOKEN : ${{ secrets.REPO_TOKEN }} 
0 commit comments