cowrie/.github/workflows/docker.yml at master · Chrzi/cowrie · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
---
name: Docker Build and Publish

on:  # yamllint disable-line rule:truthy
  push:
    # Publish `master` as Docker `latest` image.
    branches:
      - master

    # Publish `v1.2.3` tags as releases.
    tags:
      - v*

  # Run tests for any PRs.
  pull_request:

  # Run manually
  workflow_dispatch:
    inputs:
      logLevel:
        description: 'Log level'
        required: true
        default: 'warning'
      tags:
        description: 'Build and publish Docker image'

env:
  IMAGE_NAME: cowrie

jobs:
  # Push image to GitHub Packages.
  # See also https://docs.docker.com/docker-hub/builds/
  push:
    # Ensure test job passes before pushing image.
    # needs: tox

    runs-on: ubuntu-latest
    permissions:
      id-token: write  # Required for cosign OIDC

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: set SOURCE_DATE_EPOCH
        run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3.8.0
        if: ${{ (github.event_name != 'pull_request') && (github.repository == 'cowrie/cowrie') }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          platforms: linux/amd64,linux/arm64

      - name: Login to Docker Hub
        if: ${{ (github.event_name != 'pull_request') && (github.repository == 'cowrie/cowrie') }}
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build Container Image
        id: build
        uses: docker/build-push-action@v6
        with:
          push: false
          load: true
          tags: cowrie:test
          file: docker/Dockerfile

      - name: Test
        run: |
          docker run -d --rm cowrie:test

      - name: Push Container Image
        id: push
        if: ${{ (github.event_name != 'pull_request') && (github.repository == 'cowrie/cowrie') }}
        uses: docker/build-push-action@v6
        with:
          file: docker/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: true
          load: false
          sbom: true
          provenance: true
          tags: cowrie/cowrie:latest

      - name: Sign the images with GitHub OIDC Token
        if: ${{ (github.event_name != 'pull_request') && (github.repository == 'cowrie/cowrie') }}
        env:
          DIGEST: ${{ steps.push.outputs.digest }}
          COSIGN_EXPERIMENTAL: 1
        run: |
          cosign sign -y cowrie/cowrie@${DIGEST}
          cosign verify cowrie/cowrie --certificate-oidc-issuer-regexp 'https://token.actions.githubusercontent.com' --certificate-identity 'https://github.com/cowrie/cowrie/.github/workflows/docker.yml@refs/heads/master'