equals215/deepsentinel

name: deepSentinel SLSA3 build and release
on:
  workflow_dispatch:
  push:
    tags:
      - "v*"

permissions: read-all

env:
  IMAGE_REGISTRY: ghcr.io
  IMAGE_OWNER: equals215
  IMAGE_NAME: deepsentinel-server

jobs:
  tests:
    uses: ./.github/workflows/go-tests-coverage.yml
  build:
    needs: [tests]
    strategy:
      matrix:
        component:
          - server
          - agent
        os:
          - linux
          - darwin
        arch:
          - amd64
          - arm64
    permissions:
      id-token: write # To sign.
      contents: write # To upload release assets.
      actions: read   # To read workflow path.
    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.10.0
    with:
      go-version: 1.22.2
      config-file: .github/workflows/slsa3-configs/${{ matrix.component }}-${{ matrix.os }}-${{ matrix.arch }}.yml
      prerelease: true
  
  package:
    needs: [tests, build]
    permissions:
      contents: read
      packages: write
    outputs:
      image: ${{ steps.image.outputs.image }}
      digest: ${{ steps.build.outputs.digest }}
    runs-on: ubuntu-latest
    steps:
      - name: Checkout the repository
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v2

      - name: Authenticate Docker
        uses: docker/login-action@v2
        with:
          registry: ${{ env.IMAGE_REGISTRY }}
          username: ${{ env.IMAGE_OWNER }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v4.0.1
        with:
          images: |
            ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_OWNER }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=tag
            type=sha

      - name: Build and push Docker image
        uses: docker/build-push-action@v3.0.0
        id: build
        with:
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          platforms: linux/amd64,linux/arm64
          file: Dockerfile.server

      - name: Output image
        id: image
        run: |
          image_name="${IMAGE_REGISTRY}/${IMAGE_OWNER}/${IMAGE_NAME}"
          echo "image=$image_name" >> "$GITHUB_OUTPUT"

  # This step calls the container workflow to generate provenance and push it to
  # the container registry.
  package-provenance:
    needs: [package]
    permissions:
      actions: read
      id-token: write
      packages: write
    if: startsWith(github.ref, 'refs/tags/')
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.10.0
    with:
      image: ${{ needs.package.outputs.image }}
      digest: ${{ needs.package.outputs.digest }}
      registry-username: ${{ github.actor }}
    secrets:
      registry-password: ${{ secrets.GITHUB_TOKEN }}