element-web/.github/workflows/cd.yaml

name: CD # Continuous Delivery
on:
    push:
        branches: [master, staging, develop]
        paths:
            - "**/Dockerfile"
            - "**/dockerbuild"
            - "**/docker"
            - "**/docker-*"
            - "pnpm-lock.yaml"

concurrency: ${{ github.workflow }}-${{ github.ref_name }}

permissions: {}
env:
    NX_DEFAULT_OUTPUT_STYLE: stream-without-prefixes

jobs:
    docker:
        name: Docker Bake
        runs-on: ubuntu-24.04
        permissions:
            id-token: write # needed for signing the images with GitHub OIDC Token
            packages: write # needed for publishing packages to GHCR
            # Needed for nx-set-shas
            contents: read
            actions: read
        steps:
            - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
              with:
                  persist-credentials: false

            - name: Install Cosign
              uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

            - name: Set up QEMU
              uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4

            - name: Set up Docker Buildx
              id: builder
              uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4

            - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
              with:
                  node-version-file: package.json
                  cache: "pnpm"

            - name: Install Deps
              run: "pnpm install --frozen-lockfile"

            - name: Login to GitHub Container Registry
              uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
              with:
                  registry: ghcr.io
                  username: ${{ github.repository_owner }}
                  password: ${{ secrets.GITHUB_TOKEN }}

            # Fudge and run this separately rather than relying on the dependency,
            # otherwise nx does not appear to pick up the .env file that playwright
            # common's prebuild step creates.
            - run: pnpm nx run-many --nxBail -t docker:prebuild
              env:
                  INPUT_BUILDER: ${{ steps.builder.outputs.name }}

            - run: pnpm nx run-many --nxBail -t docker:build
              id: build
              env:
                  INPUT_PUSH: true
                  INPUT_LOAD: false
                  INPUT_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                  INPUT_BUILDER: ${{ steps.builder.outputs.name }}

            - name: Sign the images with GitHub OIDC token
              run: |
                  shopt -s globstar

                  for FILE in ./node_modules/.cache/nx-container/**/metadata; do
                      TARGET=$(jq -r '(.["image.name"] | split(",") | last) + "@" + .["containerimage.digest"]' "$FILE")
                      echo "Signing $TARGET..."
                      cosign sign --yes "$TARGET"
                  done