release-image.yaml

---
name: "Release Image"
on:
  workflow_call:
    inputs:
      image-name:
        required: true
        type: string
      full-tag:
        required: true
        type: string
      short-tag:
        required: true
        type: string
      create-attestation:
        required: false
        type: boolean
        default: false
    secrets:
      github-token:
        required: true
      image-registry:
        required: true
      image-registry-username:
        required: true
      image-registry-password:
        required: true
permissions:
  contents: read
jobs:
  create_action_images:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    env:
      IMAGE_REGISTRY: ${{ secrets.image-registry }}
      IMAGE_REGISTRY_USERNAME: ${{ secrets.image-registry-username }}
      IMAGE_REGISTRY_PASSWORD: ${{ secrets.image-registry-password }}
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
        with:
          egress-policy: audit
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
      - name: Log in to the Container registry
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2
        with:
          registry: ${{ env.IMAGE_REGISTRY }}
          username: ${{ env.IMAGE_REGISTRY_USERNAME }}
          password: ${{ env.IMAGE_REGISTRY_PASSWORD}}
      - name: Push Docker Image
        if: ${{ success() }}
        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
        id: push
        with:
          context: .
          file: ./Dockerfile
          push: true
          tags: |
            ${{ env.IMAGE_REGISTRY }}/${{ inputs.image-name }}:latest
            ${{ env.IMAGE_REGISTRY }}/${{ inputs.image-name }}:${{ inputs.full-tag }}
            ${{ env.IMAGE_REGISTRY }}/${{ inputs.image-name }}:${{ inputs.short-tag }}
          platforms: linux/amd64,linux/arm64
          provenance: false
          sbom: false
      - name: Generate artifact attestation
        if: ${{ inputs.create-attestation }}
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-name: ${{ env.IMAGE_REGISTRY }}/${{ inputs.image-name}}
          subject-digest: ${{ steps.push.outputs.digest }}
          push-to-registry: true
          github-token: ${{ secrets.github-token }}