dockerhub.yml

---
name: Docker Hub

on:
  push:
  schedule:
    - cron: "0 0 * * 0"
  workflow_dispatch:

permissions: {}

jobs:
  dockerhub:
    if: startsWith(github.ref, 'refs/heads/')
    runs-on: ubuntu-latest
    strategy:
      matrix:
        platform: ["linux/amd64", "linux/arm64"]
        tag: ["main", "latest"]
    steps:
      - name: Set IMAGE
        shell: bash
        run: |
          set -euo pipefail
          IFS=$'\n\t'	
          echo "IMAGE=${GITHUB_REPOSITORY#*/docker-}" >> "${GITHUB_ENV}"
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 1
          persist-credentials: false
      - name: Pull the ${{ matrix.tag }} ${{ matrix.platform }} image
        shell: bash
        env:
          PLATFORM: ${{ matrix.platform }}
          TAG: ${{ matrix.tag }}
        run: |
          set -euo pipefail
          IFS=$'\n\t'
          docker pull --platform "${PLATFORM}" "${GITHUB_REPOSITORY_OWNER}/${IMAGE}:${TAG}"
      - name: Pull the ${{ matrix.tag }} ${{ matrix.platform }} image SBOM
        shell: bash
        env:
          PLATFORM: ${{ matrix.platform }}
          TAG: ${{ matrix.tag }}
        run: |
          set -euo pipefail
          IFS=$'\n\t'
          docker buildx imagetools inspect "${GITHUB_REPOSITORY_OWNER}/${IMAGE}:${TAG}" --format "{{ json (index .SBOM \"${PLATFORM}\").SPDX }}"
      - name: Install cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
      - name: Verify the ${{ matrix.tag }} image signature
        shell: bash
        env:
          TAG: ${{ matrix.tag }}
        run: |
          set -euo pipefail
          IFS=$'\n\t'
          cosign verify "${GITHUB_REPOSITORY_OWNER}/${IMAGE}:${TAG}" --certificate-identity-regexp "https://github\.com/${GITHUB_REPOSITORY}/\.github/workflows/.+" --certificate-oidc-issuer 'https://token.actions.githubusercontent.com'