release.yml

name: Release & Deploy

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment to deploy to'
        required: true
        default: 'staging'
        type: choice
        options:
          - staging
          - production

env:
  REGISTRY: ghcr.io
  API_IMAGE_NAME: ${{ github.repository }}/api
  WEB_IMAGE_NAME: ${{ github.repository }}/web
  WORKER_IMAGE_NAME: ${{ github.repository }}/worker

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write  # Required for cosign keyless signing

    outputs:
      api_digest: ${{ steps.api_push.outputs.digest }}
      web_digest: ${{ steps.web_push.outputs.digest }}
      worker_digest: ${{ steps.worker_push.outputs.digest }}

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata for API
        id: api_meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.API_IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=

      - name: Extract metadata for Web
        id: web_meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.WEB_IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=

      - name: Extract metadata for Worker
        id: worker_meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.WORKER_IMAGE_NAME }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,prefix=

      # Build and push API image
      - name: Build and push API image
        id: api_push
        uses: docker/build-push-action@v5
        with:
          context: ./api
          file: ./api/Dockerfile
          push: true
          tags: ${{ steps.api_meta.outputs.tags }}
          labels: ${{ steps.api_meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          target: production

      # Build and push Web image
      - name: Build and push Web image
        id: web_push
        uses: docker/build-push-action@v5
        with:
          context: ./web
          file: ./web/Dockerfile
          push: true
          tags: ${{ steps.web_meta.outputs.tags }}
          labels: ${{ steps.web_meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          target: production

      # Build and push Worker image (same as API with different entrypoint)
      - name: Build and push Worker image
        id: worker_push
        uses: docker/build-push-action@v5
        with:
          context: ./api
          file: ./api/Dockerfile
          push: true
          tags: ${{ steps.worker_meta.outputs.tags }}
          labels: ${{ steps.worker_meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          target: production

  # L-05: Container Image Signing with Cosign
  sign-images:
    runs-on: ubuntu-latest
    needs: [build-and-push]
    permissions:
      contents: read
      packages: write
      id-token: write  # Required for keyless signing

    steps:
      - name: Install Cosign
        uses: sigstore/cosign-installer@v3

      - name: Log in to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Sign API image using keyless signing (OIDC)
      - name: Sign API image
        run: |
          cosign sign --yes \
            ${{ env.REGISTRY }}/${{ env.API_IMAGE_NAME }}@${{ needs.build-and-push.outputs.api_digest }}
        env:
          COSIGN_EXPERIMENTAL: 1

      # Sign Web image
      - name: Sign Web image
        run: |
          cosign sign --yes \
            ${{ env.REGISTRY }}/${{ env.WEB_IMAGE_NAME }}@${{ needs.build-and-push.outputs.web_digest }}
        env:
          COSIGN_EXPERIMENTAL: 1

      # Sign Worker image
      - name: Sign Worker image
        run: |
          cosign sign --yes \
            ${{ env.REGISTRY }}/${{ env.WORKER_IMAGE_NAME }}@${{ needs.build-and-push.outputs.worker_digest }}
        env:
          COSIGN_EXPERIMENTAL: 1

      # Verify signatures
      - name: Verify API image signature
        run: |
          cosign verify \
            --certificate-identity-regexp=".*" \
            --certificate-oidc-issuer-regexp=".*" \
            ${{ env.REGISTRY }}/${{ env.API_IMAGE_NAME }}@${{ needs.build-and-push.outputs.api_digest }}
        env:
          COSIGN_EXPERIMENTAL: 1

      - name: Verify Web image signature
        run: |
          cosign verify \
            --certificate-identity-regexp=".*" \
            --certificate-oidc-issuer-regexp=".*" \
            ${{ env.REGISTRY }}/${{ env.WEB_IMAGE_NAME }}@${{ needs.build-and-push.outputs.web_digest }}
        env:
          COSIGN_EXPERIMENTAL: 1

      - name: Verify Worker image signature
        run: |
          cosign verify \
            --certificate-identity-regexp=".*" \
            --certificate-oidc-issuer-regexp=".*" \
            ${{ env.REGISTRY }}/${{ env.WORKER_IMAGE_NAME }}@${{ needs.build-and-push.outputs.worker_digest }}
        env:
          COSIGN_EXPERIMENTAL: 1

  # Generate SBOM for container images
  container-sbom:
    runs-on: ubuntu-latest
    needs: [build-and-push, sign-images]
    permissions:
      contents: read
      packages: read

    steps:
      - name: Install Syft
        uses: anchore/sbom-action/download-syft@v0

      - name: Log in to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      # Generate SBOM for API container
      - name: Generate SBOM for API container
        run: |
          syft ${{ env.REGISTRY }}/${{ env.API_IMAGE_NAME }}@${{ needs.build-and-push.outputs.api_digest }} \
            -o cyclonedx-json > api-container-sbom.json

      # Generate SBOM for Web container
      - name: Generate SBOM for Web container
        run: |
          syft ${{ env.REGISTRY }}/${{ env.WEB_IMAGE_NAME }}@${{ needs.build-and-push.outputs.web_digest }} \
            -o cyclonedx-json > web-container-sbom.json

      - name: Upload container SBOMs
        uses: actions/upload-artifact@v4
        with:
          name: container-sboms
          path: |
            api-container-sbom.json
            web-container-sbom.json
          retention-days: 90

  # Create GitHub Release
  release:
    runs-on: ubuntu-latest
    needs: [sign-images, container-sbom]
    if: startsWith(github.ref, 'refs/tags/v')
    permissions:
      contents: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Download SBOMs
        uses: actions/download-artifact@v4
        with:
          name: container-sboms
          path: ./sboms

      - name: Create Release
        uses: softprops/action-gh-release@v1
        with:
          generate_release_notes: true
          files: |
            ./sboms/*.json
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}