container-image.yml

name: "Container Image"

on:
  workflow_call:
  workflow_dispatch:

env:
  MAKE_STOP_ON_ERRORS: true
  MAKE_DEBUG: true

permissions:
  contents: read

jobs:
  build:
    name: Build and Publish Container Images
    runs-on: ubuntu-latest
    defaults:
      # pipefail so `make ... | tee $GITHUB_STEP_SUMMARY` propagates the
      # upstream make exit code instead of being swallowed by tee's exit 0.
      run:
        shell: bash -eo pipefail {0}
    permissions:
      contents: read
      packages: write
      id-token: write
    steps:
      - name: Check out code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      - name: Install Podman and cross-arch emulation
        # qemu-user-static + binfmt-support register QEMU user-mode handlers
        # in /proc/sys/fs/binfmt_misc so podman can RUN steps inside arm64
        # images on this amd64 runner (the Containerfile's `apk add` step
        # otherwise dies with "exec /bin/sh: Exec format error").
        run: |
          sudo apt-get update
          sudo apt-get install -y podman qemu-user-static binfmt-support

      - name: Tools and versions
        run: |
          echo "# Container Image Summary" > $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "## Tools and versions" >> $GITHUB_STEP_SUMMARY

          podman_version=$(podman --version | awk '{print $3}')
          echo "Podman version: $podman_version"
          echo "**Podman Version:** $podman_version" >> $GITHUB_STEP_SUMMARY

          make_version=$(make --version | head -n 1)
          echo "Make version: $make_version"
          echo "**Make Version:** $make_version" >> $GITHUB_STEP_SUMMARY

      - name: Download Distribution files
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: dist
          path: ./dist/

      - name: Make container-build
        run: |
          echo "## Make container-build" >> $GITHUB_STEP_SUMMARY
          GIT_VERSION=${{ github.ref_name }} make container-build | tee -a $GITHUB_STEP_SUMMARY

      - name: Show container images
        run: |
          echo "## Show container images" >> $GITHUB_STEP_SUMMARY
          podman images | tee -a $GITHUB_STEP_SUMMARY

      - name: Make container-login
        run: |
          echo "## Make container-login" >> $GITHUB_STEP_SUMMARY
          GIT_VERSION=${{ github.ref_name }} REPOSITORY_REGISTRY_TOKEN=${{ secrets.GITHUB_TOKEN }} REPOSITORY_REGISTRY_USERNAME=${{ github.actor }} make container-login | tee -a $GITHUB_STEP_SUMMARY

      - name: Make container-publish
        run: |
          echo "## Make container-publish" >> $GITHUB_STEP_SUMMARY
          GIT_VERSION=${{ github.ref_name }} make container-publish | tee -a $GITHUB_STEP_SUMMARY

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2

      - name: Cosign sign published container manifest (keyless / Sigstore)
        env:
          GIT_VERSION: ${{ github.ref_name }}
          COSIGN_YES: "true"
        run: |
          echo "## Cosign sign container manifest" >> $GITHUB_STEP_SUMMARY
          # Reuse the same GHCR credentials that podman used in the publish step.
          echo "${{ secrets.GITHUB_TOKEN }}" \
            | cosign login ghcr.io --username "${{ github.actor }}" --password-stdin
          IMAGE="ghcr.io/${{ github.repository }}"
          # Sign by tag — cosign internally HEADs the registry to resolve the
          # tag to its authoritative on-registry digest and signs that digest;
          # the signature is stored under that digest, not under the tag. We
          # previously resolved the digest locally with `podman manifest
          # inspect`, but (a) that JSON has no top-level `.digest` for a
          # manifest list and the `.manifests[0].digest` fallback returns the
          # *first per-arch* image's digest, not the list's, and (b) podman
          # re-serializes during push, so the local digest does not exist on
          # GHCR. Result: cosign got MANIFEST_UNKNOWN.
          # --recursive covers the manifest and every per-platform image
          # under it. The classic "signing by tag races with concurrent
          # pushes" caveat doesn't apply here: this job exclusively owns
          # these tags and has just pushed them.
          for TAG in "${GIT_VERSION}" "latest"; do
            cosign sign --recursive "${IMAGE}:${TAG}" | tee -a $GITHUB_STEP_SUMMARY
            echo "**Signed:** \`${IMAGE}:${TAG}\`" >> $GITHUB_STEP_SUMMARY
          done