build-and-push.yaml

# Builds and pushes docker images on main and tags

name: Build and Push Docker images
on:
  push:
    branches:
      - main
      - "release/**"
    paths:
      - "Makefile"
      - "pom.xml"
      - ".github/workflows/build-and-push.yaml"
      - "config"
      - "src/**"
    tags:
      - '*'

jobs:
  build:
    if: github.repository == 'groldan/geoserver-cloud'
    name: Build and Push
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
    - name: Install Cosign
      uses: sigstore/cosign-installer@v3.5.0

    - name: Login to Docker Hub
      uses: docker/login-action@v1
      with:
        username: ${{ secrets.DOCKER_HUB_USERNAME }}
        password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}

    - name: Checkout
      uses: actions/checkout@v2
      with:
        submodules: recursive

    - name: Setup Java
      uses: actions/setup-java@v2
      with:
        distribution: 'temurin'
        java-version: '21'
        cache: 'maven'

    - name: Validate source code formatting
      run: make lint

    - name: Build without tests
      run: |
        make install

    - name: Build images
      run: |
        make build-image
      env:
        DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}

    - name: Write signing key to disk (only needed for `cosign sign --key`)
      run: echo "${{ secrets.COSIGN_KEY }}" > cosign.key

    - name: Push images
      run: |
        make push-image
      env:
        DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}

    - name: Sign images
      run: |
        make sign-image
      env:
        COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
        DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}

    - name: Write pub key to disk (for verification)
      run: echo "${{ secrets.COSIGN_PUB_KEY }}" > cosign.pub

    - name: Verify images
      run: |
        make verify-image
      env:
        COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
        DOCKER_HUB_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}

    - name: Remove project jars from cached repository
      run: |
        rm -rf ~/.m2/repository/org/geoserver
        find ~/.m2/repository -name "*SNAPSHOT*" -type d | xargs rm -rf {}