Stirling-PDF/.github/workflows/push-docker-base.yml

name: Push Docker Base Image

on:
  push:
    branches:
      - baseDockerImage
      - accessIssueFix
  workflow_dispatch:
    inputs:
      version:
        description: 'Base image version (e.g., 1.0.0, 1.0.1)'
        required: true
        type: string

permissions:
  contents: read

jobs:
  push-base:
    # Own environment: docker-publish is branch-locked to release/main,
    # which excludes the baseDockerImage/accessIssueFix branches this runs on.
    environment: docker-base-publish
    if: ${{ vars.CI_PROFILE != 'lite' && github.actor == 'Frooodle' }}
    runs-on: ubuntu-24.04-8core
    permissions:
      packages: write
      id-token: write
    steps:
      - name: Verify authorized user
        run: |
          if [ "${{ github.actor }}" != "Frooodle" ]; then
            echo "Error: Only Frooodle is authorized to run this workflow"
            exit 1
          fi

      - name: Set version
        id: version
        env:
          INPUT_VERSION: ${{ github.event.inputs.version }}
        run: |
          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
            VERSION="${INPUT_VERSION}"
          elif [ "${{ github.ref_name }}" == "accessIssueFix" ]; then
            VERSION="1.0.3"
          else
            VERSION="1.0.0"
          fi
          echo "version=${VERSION}" >> $GITHUB_OUTPUT

      - name: Harden Runner
        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
        with:
          egress-policy: audit

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Login to Docker Hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          username: ${{ secrets.DOCKER_HUB_USERNAME }}
          password: ${{ secrets.DOCKER_HUB_API }}

      - name: Login to GitHub Container Registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}

      - name: Set up Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

      - name: Convert repository owner to lowercase
        id: repoowner
        run: echo "lowercase=$(echo ${{ github.repository_owner }} | awk '{print tolower($0)}')" >> $GITHUB_OUTPUT

      - name: Generate tags for base image
        id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: |
            ${{ secrets.DOCKER_HUB_ORG_USERNAME }}/stirling-pdf-base
            ghcr.io/${{ steps.repoowner.outputs.lowercase }}/stirling-pdf-base
          tags: |
            type=raw,value=${{ steps.version.outputs.version }}

      - name: Build and push base image
        id: build-push-base
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          builder: ${{ steps.buildx.outputs.name }}
          context: docker/base
          file: ./docker/base/Dockerfile
          push: true
          cache-from: type=gha,scope=stirling-pdf-base
          cache-to: type=gha,mode=max,scope=stirling-pdf-base
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          platforms: linux/amd64,linux/arm64/v8
          provenance: true
          sbom: true

      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
        with:
          cosign-release: "v2.4.1"

      - name: Sign base images
        env:
          DIGEST: ${{ steps.build-push-base.outputs.digest }}
          TAGS: ${{ steps.meta.outputs.tags }}
          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
        run: |
          if [ -n "$COSIGN_PRIVATE_KEY" ]; then
            echo "$TAGS" | tr ',' '\n' | while read -r tag; do
              cosign sign --yes \
                --key env://COSIGN_PRIVATE_KEY \
                "${tag}@${DIGEST}"
            done
          else
            echo "Warning: COSIGN_PRIVATE_KEY not set, skipping image signing"
          fi