build.yml

name: Build

on:
  workflow_dispatch:
  schedule:
    - cron: '0 6 * * 5' # Every Friday at 06:00 UTC
  push:
    branches:
      - '**'
    paths-ignore:
      - '**/*.md'
      - '**/*.png'
      - ".vscode/**"
      - "example/**"
      - "debug.sh"
      - "LICENSE"

    tags:
      - 'v*'
  pull_request:
    branches:
      - main
    paths-ignore:
      - '**/*.md'
      - '**/*.png'
      - ".vscode/**"
      - "example/**"
      - "debug.sh"
      - "LICENSE"

env:
  DOCKER_REGISTRY: ghcr.io
  DOCKER_FULL_IMAGE_NAME: ghcr.io/chrschu90/cryptomator-vault-sync # Make sure to use lowercase only
  DOCKER_PLATFORMS: linux/amd64,linux/arm64/v8

jobs:
  build:
    name: Build
    runs-on: ubuntu-latest
    permissions:
      packages: write # Docker push image to GHCR
      id-token: write # GHCR auth and Cosign OIDC signing/verification
      contents: write # Create/update GitHub Releases
    steps:
    - name: Checkout
      uses: actions/checkout@v7
      with:
        fetch-depth: 0
        fetch-tags: true

    - name: Get Version from Tag
      uses: ChrSchu90/GitTagSemanticVersion@v1.1
      if: startsWith(github.event.ref, 'refs/tags/v')
      id: tagver

    - name: Docker QEMU Setup
      uses: docker/setup-qemu-action@v4

    - name: Docker Buildx Setup
      uses: docker/setup-buildx-action@v4

    - name: Cosign Setup
      uses: sigstore/cosign-installer@v4.1.2

    - name: Run Tests
      run: chmod +x ./tests/test.sh && ./tests/test.sh

    - name: Docker Login
      uses: docker/login-action@v4
      if: ${{ steps.tagver.outputs.is_valid == 'true' }}
      with:
        registry: ${{ env.DOCKER_REGISTRY }}
        username: ${{ github.repository_owner }}
        password: ${{ secrets.GITHUB_TOKEN }}       

    - name: Docker tags/labels
      uses: docker/metadata-action@v6
      id: dockermeta
      with:
        images: ${{ env.DOCKER_FULL_IMAGE_NAME }}
        tags: |
          # Specific stable patch version (fully pinned)
          type=raw,value=${{ steps.tagver.outputs.version }},enable=${{ steps.tagver.outputs.is_release == 'true' }}
          # Latest stable release in major + minor version
          type=raw,value=${{ steps.tagver.outputs.major }}.${{ steps.tagver.outputs.minor }},enable=${{ steps.tagver.outputs.is_release == 'true' }}
          # Latest stable release in major version
          type=raw,value=${{ steps.tagver.outputs.major }},enable=${{ steps.tagver.outputs.is_release == 'true' }}
          # latest - Most recent stable release
          type=raw,value=latest,enable=${{ steps.tagver.outputs.is_release == 'true' }}
          # Specific preview build (fully pinned)
          type=raw,value=${{ steps.tagver.outputs.version }}-${{ steps.tagver.outputs.suffix }},enable=${{ steps.tagver.outputs.is_prerelease == 'true' }}
          # Latest preview for minor + minor + patch version
          type=raw,value=${{ steps.tagver.outputs.version }}-preview,enable=${{ steps.tagver.outputs.is_prerelease == 'true' || steps.tagver.outputs.is_release == 'true' }}
          # Latest preview for minor + minor version
          type=raw,value=${{ steps.tagver.outputs.major }}.${{ steps.tagver.outputs.minor }}-preview,enable=${{ steps.tagver.outputs.is_prerelease == 'true' || steps.tagver.outputs.is_release == 'true' }}
          # Latest preview for major version
          type=raw,value=${{ steps.tagver.outputs.major }}-preview,enable=${{ steps.tagver.outputs.is_prerelease == 'true' || steps.tagver.outputs.is_release == 'true' }}
          # Latest preview build
          type=raw,value=preview,enable=${{ steps.tagver.outputs.is_prerelease == 'true' || steps.tagver.outputs.is_release == 'true' }}
          # Test build
          type=raw,value=ci,enable=${{ steps.tagver.outputs.is_valid != 'true' }}

    - name: Docker build/push
      uses: docker/build-push-action@v7
      if: ${{ steps.dockermeta.outcome == 'success' }}
      id: docker_build
      with:
        context: .
        push: ${{ steps.tagver.outputs.is_valid == 'true' }}
        platforms: ${{ env.DOCKER_PLATFORMS }}
        tags: ${{ steps.dockermeta.outputs.tags }}
        labels: ${{ steps.dockermeta.outputs.labels }}
        annotations: ${{ steps.dockermeta.outputs.annotations }}
        #cache-from: type=gha
        #cache-to: type=gha,mode=max

    - name: Sign Docker Image
      if: ${{ steps.tagver.outputs.is_valid == 'true' }}
      id: docker_sign
      shell: bash
      env:
        IMAGE_REF: ${{ env.DOCKER_FULL_IMAGE_NAME }}@${{ steps.docker_build.outputs.digest }}
      run: |
        echo "::notice::Signing image: ${IMAGE_REF}"
        for i in {1..5}; do
          if cosign sign --yes "${IMAGE_REF}"; then
            echo "Signed: ${IMAGE_REF}"
            echo "signed=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          echo "Signing attempt ${i} failed, retrying..."
          sleep $((2 ** i))
        done
        echo "signed=false" >> "$GITHUB_OUTPUT"
        echo "::error::Failed to sign image ${IMAGE_REF}"
        exit 1

    - name: Verify Docker Image
      if: ${{ steps.tagver.outputs.is_valid == 'true' }}
      id: docker_verify
      shell: bash
      env:
        IMAGE_REF: ${{ env.DOCKER_FULL_IMAGE_NAME }}@${{ steps.docker_build.outputs.digest }}
        COSIGN_IDENTITY: ^https://github.com/${{ github.repository }}/\.github/workflows/build\.yml@refs/tags/v.*$
        COSIGN_ISSUER: https://token.actions.githubusercontent.com
      run: |
        echo "::notice::Verifying image: ${IMAGE_REF}"
        for i in {1..5}; do
          if cosign verify \
            --certificate-identity-regexp "${COSIGN_IDENTITY}" \
            --certificate-oidc-issuer "${COSIGN_ISSUER}" \
            "${IMAGE_REF}"; then
            echo "Image verified: ${IMAGE_REF}"
            echo "verified=true" >> "$GITHUB_OUTPUT"
            exit 0
          fi
          echo "Verification attempt ${i} failed, retrying..."
          sleep $((2 ** i))
        done
        echo "verified=false" >> "$GITHUB_OUTPUT"
        echo "::error::Image verification failed for ${IMAGE_REF}"
        exit 1

    - name: Create Release
      uses: softprops/action-gh-release@v3
      if: ${{ steps.tagver.outputs.is_valid == 'true' }}
      with:        
        tag_name: ${{ steps.tagver.outputs.version_tag }}
        prerelease: ${{ steps.tagver.outputs.is_prerelease == 'true' }}
        make_latest: ${{ steps.tagver.outputs.is_release == 'true' }}
        generate_release_notes: true