release.yml

---
name: Release

on:
  push:
    tags:
      - "*"

permissions: {}

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      packages: write
    steps:
      - name: Checkout
        id: checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Install cosign
        id: install_cosign
        uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1

      - name: Configure AWS Credentials
        id: configure_aws_credentials
        uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
        with:
          aws-region: eu-west-2
          role-to-assume: arn:aws:iam::730335344807:role/modernisation-platform-oidc-cicd

      - name: Login to Amazon ECR
        id: login_ecr
        uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076
        with:
          registries: 374269020027

      - name: Build and Push
        id: build_and_push
        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
        with:
          push: true
          tags: 374269020027.dkr.ecr.eu-west-2.amazonaws.com/analytical-platform-ingestion-notify:${{ github.ref_name }}

      - name: Sign
        id: sign
        shell: bash
        run: |
          cosign sign --yes 374269020027.dkr.ecr.eu-west-2.amazonaws.com/analytical-platform-ingestion-notify@${{ steps.build_and_push.outputs.digest }}

      - name: Verify
        id: verify
        run: |
          cosign verify \
            --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
            --certificate-identity=https://github.com/ministryofjustice/analytical-platform-ingestion-notify/.github/workflows/release.yml@refs/tags/${{ github.ref_name }} \
            374269020027.dkr.ecr.eu-west-2.amazonaws.com/analytical-platform-ingestion-notify@${{ steps.build_and_push.outputs.digest }}