name: MobilityOps release evidence

on:
  push:
    tags: ["v*"]

jobs:
  release-evidence:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - name: Build commit-labelled release images
        run: |
          docker build --target runtime --build-arg VCS_REF="$GITHUB_SHA" --tag mobilityops-api-release --file backend/Dockerfile .
          docker build --build-arg VCS_REF="$GITHUB_SHA" --tag mobilityops-web-release frontend
      - name: Generate API CycloneDX SBOM
        uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # v0.30.0
        with:
          scan-type: image
          image-ref: mobilityops-api-release
          format: cyclonedx
          output: mobilityops-api-sbom.cdx.json
      - name: Generate web CycloneDX SBOM
        uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # v0.30.0
        with:
          scan-type: image
          image-ref: mobilityops-web-release
          format: cyclonedx
          output: mobilityops-web-sbom.cdx.json
      - name: Record immutable image metadata
        run: |
          docker image inspect mobilityops-api-release > mobilityops-api-image.json
          docker image inspect mobilityops-web-release > mobilityops-web-image.json
          sha256sum mobilityops-*-sbom.cdx.json mobilityops-*-image.json > SHA256SUMS
      - name: Upload release evidence
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: mobilityops-${{ github.ref_name }}-evidence
          path: |
            mobilityops-*-sbom.cdx.json
            mobilityops-*-image.json
            SHA256SUMS