mirror of
https://github.com/nais/wonderwall.git
synced 2026-05-07 00:46:56 +00:00
0b3cd4d9f6
Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v3...v4) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
49 lines
1.7 KiB
YAML
49 lines
1.7 KiB
YAML
name: Build wonderwall
|
|
on: [push]
|
|
env:
|
|
GOOGLE_REGISTRY: europe-north1-docker.pkg.dev/nais-io/nais/images
|
|
GITHUB_REGISTRY: ghcr.io
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-20.04
|
|
steps:
|
|
- name: Checkout latest code
|
|
uses: actions/checkout@v4 # ratchet:actions/checkout@v3
|
|
- name: Set up Go
|
|
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # ratchet:actions/setup-go@v4
|
|
with:
|
|
go-version: "1.21"
|
|
check-latest: true
|
|
- name: Test Go
|
|
run: |
|
|
make test
|
|
make check
|
|
publish-images:
|
|
needs: test
|
|
name: Publish to Google and GitHub registries
|
|
if: github.ref == 'refs/heads/master'
|
|
permissions:
|
|
contents: "read"
|
|
id-token: "write"
|
|
packages: "write"
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4 # ratchet:actions/checkout@v3
|
|
- name: Install cosign
|
|
uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # ratchet:sigstore/cosign-installer@main
|
|
with:
|
|
cosign-release: 'v2.0.0'
|
|
- name: Verify runner image
|
|
run: cosign verify --certificate-oidc-issuer https://accounts.google.com --certificate-identity keyless@distroless.iam.gserviceaccount.com gcr.io/distroless/static-debian11:nonroot
|
|
- uses: nais/platform-build-push-sign@fb7da39ee56c8904ed15c02705a1780cb278a65b # ratchet:nais/platform-build-push-sign@main
|
|
id: build_push_sign
|
|
with:
|
|
name: wonderwall
|
|
dockerfile: Dockerfile
|
|
google_service_account: gh-wonderwall
|
|
multi-platform: true
|
|
push: true
|
|
push_ghcr: true
|
|
workload_identity_provider: ${{ secrets.NAIS_IO_WORKLOAD_IDENTITY_PROVIDER }}
|