.github/workflows/ghcr-build-push.yml

name: GHCR Build + Push (uds-v0.2.0)
# Builds the root Dockerfile and pushes to ghcr.io/szl-holdings/<repo>.
# Unblocks Warhacker UDS bundle chain (FA-01).
# Uses GITHUB_TOKEN for GHCR auth (a11oy repo is PUBLIC, package creation allowed).
# Adds uds-v0.2.0 + latest tags. Cosign keyless OIDC signing.
# DCO: Signed-off-by: Yachay <yachay@szlholdings.ai>
on:
  push:
    branches: [main]
    tags: ['v*', 'uds-v*']
  workflow_dispatch:
jobs:
  build-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
        id: build-push
        with:
          context: .
          push: true
          tags: |
            ghcr.io/szl-holdings/${{ github.event.repository.name }}:uds-v0.2.0
            ghcr.io/szl-holdings/${{ github.event.repository.name }}:latest
      - name: Attest build provenance (SLSA L2)
        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
        with:
          subject-name: ghcr.io/szl-holdings/${{ github.event.repository.name }}
          subject-digest: ${{ steps.build-push.outputs.digest }}
          push-to-registry: true
      - uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.8.1
      - name: cosign sign
        env:
          COSIGN_EXPERIMENTAL: "1"
        run: |
          cosign sign --yes ghcr.io/szl-holdings/${{ github.event.repository.name }}:uds-v0.2.0
          cosign sign --yes ghcr.io/szl-holdings/${{ github.event.repository.name }}:latest