build-and-publish.yaml

on:
  push:
    branches:
      - main
  workflow_dispatch:
    branches:
      - main

jobs:
  build_image:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/pvnovarese/example-ci:main
    steps:
      - uses: actions/checkout@v2

      - name: "build and push the image"
        run: |
          IMAGE="ghcr.io/pvnovarese/example:git-$GITHUB_SHA"

          docker build -t "$IMAGE" .

          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u pvnovarese --password-stdin
          docker push "$IMAGE"

  sign_image:
    needs: build_image
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/pvnovarese/example-ci:main
    steps:
      - name: "sign the image"
        env:
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u pvnovarese --password-stdin
          echo "${{ secrets.COSIGN_KEY }}" > cosign.key

          IMAGE="ghcr.io/pvnovarese/example:git-$GITHUB_SHA"

          # Sign the image (...and this step pushes the signature to the registry, too)
          cosign sign -key ./cosign.key "$IMAGE"

  create_image_sbom:
    needs: build_image
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/pvnovarese/example-ci:main
    steps:
      - name: "create the SBOM"
        run: |
          IMAGE="ghcr.io/pvnovarese/example:git-$GITHUB_SHA"

          # We're using `jq` only to minimize the size of the SBOM payload. In the future, Syft might produce compacted JSON data by default.

          syft "registry:$IMAGE" -o json | jq --compact-output > ./sbom.syft.json

      - uses: actions/upload-artifact@v2
        with:
          name: sbom.syft.json
          path: ./sbom.syft.json

  scan_for_vulnerabilities:
    needs: create_image_sbom
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/pvnovarese/example-ci:main
    steps:
      - uses: actions/download-artifact@v2
        with:
          name: sbom.syft.json

      - name: "scan for vulnerabilities"
        run: |
          # Normally, we'd fail the pipeline if we detect vulnerabilities above a certain severity threshold. But for this example, we won't, so that the remaining steps can be demonstrated.

          grype sbom:./sbom.syft.json -o json | jq --compact-output > ./vulnerability-report.grype.json

      - uses: actions/upload-artifact@v2
        with:
          name: vulnerability-report.grype.json
          path: ./vulnerability-report.grype.json

  create_sbom_attestation:
    needs: create_image_sbom
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/pvnovarese/example-ci:main
    steps:
      - uses: actions/download-artifact@v2
        with:
          name: sbom.syft.json

      - name: "attest the sbom"
        env:
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
          SBOM_FILE: ./sbom.syft.json
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u pvnovarese --password-stdin
          echo "${{ secrets.COSIGN_KEY }}" > cosign.key

          IMAGE="ghcr.io/pvnovarese/example:git-$GITHUB_SHA"

          # Put the SBOM into a signed "attestation" about the image, and push this attestation to the registry.
          cosign attest -predicate "$SBOM_FILE" -key ./cosign.key "$IMAGE"

  create_vulnerability_scan_attestation:
    needs: scan_for_vulnerabilities
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/pvnovarese/example-ci:main
    steps:
      - uses: actions/download-artifact@v2
        with:
          name: vulnerability-report.grype.json

      - name: "attest the vulnerability scan"
        env:
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
          VULNERABILITY_SCAN_FILE: ./vulnerability-report.grype.json
        run: |
          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u pvnovarese --password-stdin
          echo "${{ secrets.COSIGN_KEY }}" > cosign.key

          IMAGE="ghcr.io/pvnovarese/example:git-$GITHUB_SHA"

          # Put the vulnerability scan report into a signed "attestation" about the image, and push this attestation to the registry.
          cosign attest -predicate "$VULNERABILITY_SCAN_FILE" -key ./cosign.key "$IMAGE"