gerbil/.github/workflows/cicd.yml

name: CI/CD Pipeline

# CI/CD workflow for building, publishing, mirroring, signing container images and building release binaries.
# Actions are pinned to specific SHAs to reduce supply-chain risk. This workflow triggers on tag push events.

permissions:
  contents: read
  packages: write      # for GHCR push
  id-token: write      # for Cosign Keyless (OIDC) Signing

# Required secrets:
# - DOCKER_HUB_USERNAME / DOCKER_HUB_ACCESS_TOKEN: push to Docker Hub
# - GITHUB_TOKEN: used for GHCR login and OIDC keyless signing
# - COSIGN_PRIVATE_KEY / COSIGN_PASSWORD / COSIGN_PUBLIC_KEY: for key-based signing

on:
    push:
        tags:
            - "[0-9]+.[0-9]+.[0-9]+"
            - "[0-9]+.[0-9]+.[0-9]+.rc.[0-9]+"

concurrency:
  group: ${{ github.ref }}
  cancel-in-progress: true

jobs:
  release:
    name: Build and Release
    runs-on: amd64-runner
    # Job-level timeout to avoid runaway or stuck runs
    timeout-minutes: 120
    env:
      # Target images
      DOCKERHUB_IMAGE: docker.io/fosrl/${{ github.event.repository.name }}
      GHCR_IMAGE: ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}

    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Log in to Docker Hub
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: docker.io
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}

      - name: Extract tag name
        id: get-tag
        run: echo "TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
        shell: bash

      - name: Install Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version: 1.26

      - name: Update version in main.go
        run: |
          TAG=${{ env.TAG }}
          if [ -f main.go ]; then
            sed -i 's/version_replaceme/'"$TAG"'/' main.go
            echo "Updated main.go with version $TAG"
          else
            echo "main.go not found"
          fi
        shell: bash

      - name: Build and push Docker images (Docker Hub)
        run: |
          TAG=${{ env.TAG }}
          make docker-build-release tag=$TAG
          echo "Built & pushed to: ${{ env.DOCKERHUB_IMAGE }}:${TAG}"
        shell: bash

      - name: Login in to GHCR
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Install skopeo + jq
        # skopeo: copy/inspect images between registries
        # jq: JSON parsing tool used to extract digest values
        run: |
          sudo apt-get update -y
          sudo apt-get install -y skopeo jq
          skopeo --version
        shell: bash

      - name: Copy tag from Docker Hub to GHCR
        # Mirror the already-built image (all architectures) to GHCR so we can sign it
        run: |
          set -euo pipefail
          TAG=${{ env.TAG }}
          echo "Copying ${{ env.DOCKERHUB_IMAGE }}:${TAG} -> ${{ env.GHCR_IMAGE }}:${TAG}"
          skopeo copy --all --retry-times 3 \
            docker://$DOCKERHUB_IMAGE:$TAG \
            docker://$GHCR_IMAGE:$TAG
        shell: bash

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
          cosign-release: v3.0.6

      - name: Dual-sign and verify (GHCR & Docker Hub)
        # Sign each image by digest using keyless (OIDC) and key-based signing,
        # then verify both the public key signature and the keyless OIDC signature.
        env:
          TAG: ${{ env.TAG }}
          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
          COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY }}
          COSIGN_YES: "true"
        run: |
          set -euo pipefail

          issuer="https://token.actions.githubusercontent.com"
          id_regex="^https://github.com/${{ github.repository }}/.+"  # accept this repo (all workflows/refs)

          for IMAGE in "${GHCR_IMAGE}" "${DOCKERHUB_IMAGE}"; do
            echo "Processing ${IMAGE}:${TAG}"

            DIGEST="$(skopeo inspect --retry-times 3 docker://${IMAGE}:${TAG} | jq -r '.Digest')"
            REF="${IMAGE}@${DIGEST}"
            echo "Resolved digest: ${REF}"

            echo "==> cosign sign (keyless) --recursive ${REF}"
            cosign sign --recursive "${REF}"

            echo "==> cosign sign (key) --recursive ${REF}"
            cosign sign --key env://COSIGN_PRIVATE_KEY --recursive "${REF}"

            echo "==> cosign verify (public key) ${REF}"
            cosign verify --key env://COSIGN_PUBLIC_KEY "${REF}" -o text

            echo "==> cosign verify (keyless policy) ${REF}"
            cosign verify \
              --certificate-oidc-issuer "${issuer}" \
              --certificate-identity-regexp "${id_regex}" \
              "${REF}" -o text
          done
        shell: bash

      - name: Build binaries
        run: |
          make go-build-release
        shell: bash

      - name: Upload artifacts from /bin
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: binaries
          path: bin/