element-web/.github/workflows/cd.yaml

name: CD # Continuous Delivery
on:
    push:
        branches: [develop]
concurrency: ${{ github.workflow }}-${{ github.ref_name }}

permissions: {}
env:
    NX_DEFAULT_OUTPUT_STYLE: static

jobs:
    docker:
        name: Docker Bake
        runs-on: ubuntu-24.04
        permissions:
            id-token: write # needed for signing the images with GitHub OIDC Token
            packages: write # needed for publishing packages to GHCR
            # Needed for nx-set-shas
            contents: read
            actions: read
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
              with:
                  # We need to fetch all branches and commits so that Nx affected has a base to compare against.
                  fetch-depth: 0
                  # reduce the size of the checkout with tree filtering,
                  # see https://github.blog/open-source/git/get-up-to-speed-with-partial-clone-and-shallow-clone/
                  filter: tree:0
                  persist-credentials: false

            - name: Prepare nx
              uses: nrwl/nx-set-shas@3e9ad7370203c1e93d109be57f3b72eb0eb511b1 # v4
              with:
                  main-branch-name: develop

            - name: Install Cosign
              uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3

            - name: Set up QEMU
              uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4

            - name: Set up Docker Buildx
              id: builder
              uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4

            - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
            - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
              with:
                  node-version-file: package.json
                  cache: "pnpm"

            - name: Install Deps
              run: "pnpm install --frozen-lockfile"

            - name: Login to GitHub Container Registry
              uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4
              with:
                  registry: ghcr.io
                  username: ${{ github.repository_owner }}
                  password: ${{ secrets.GITHUB_TOKEN }}

            - run: pnpm nx affected -t docker:build
              env:
                  INPUT_PUSH: true
                  INPUT_LOAD: false
                  INPUT_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                  INPUT_BUILDER: ${{ steps.builder.outputs.name }}

            - name: Sign the images with GitHub OIDC token
              env:
                  PATTERN: "^ghcr.io/element-hq/element-web*"
              run: |
                  docker image ls --digests --format '{{.Repository}}@{{.Digest}}' | grep "$PATTERN" | while read -r TARGET; do
                    # Check if digest is valid (not <none>)
                    if [[ "$TARGET" != *"@<none>"* ]]; then
                      echo "Signing $TARGET..."
                      cosign sign --yes "$TARGET"
                    fi
                  done