Example using a bunch of TF providers

example.tf

// Example using our bevy of TF providers (in order):
// - https://github.com/chainguard-dev/terraform-provider-apko
// - https://github.com/chainguard-dev/terraform-provider-oci
// - https://github.com/ko-build/terraform-provider-ko
// - https://github.com/chainguard-dev/terraform-provider-cosign
// - https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_run_service

// This could be a resource like:
// https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/artifact_registry_repository
variable "repo" {
  type    = string
  default = "gcr.io/jason-chainguard"
}

resource "apko_build" "base" {
  repo   = var.repo
  config = <<EOF
contents:
  repositories:
    - https://packages.wolfi.dev/os
  keyring:
    - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
  packages:
    - wolfi-baselayout
    - ca-certificates-bundle
    - tzdata

accounts:
  groups:
    - groupname: nonroot
      gid: 65532
  users:
    - username: nonroot
      uid: 65532
      gid: 65532
  run-as: 65532

archs:
  - x86_64
EOF
}

resource "oci_append" "add_config" {
  base_image = apko_build.base.image_ref
  layers = [{
    files = {
      "/usr/share/config/example.yaml" = { contents = <<EOF
hello: world
EOF
      }
    }
  }]
}

resource "ko_build" "app" {
  base_image = oci_append.add_config.image_ref
  importpath = "github.com/imjasonh/tf-example"
}

resource "cosign_sign" "signed" {
  image = ko_build.app.image_ref
}

data "cosign_verify" "verify" {
  image = cosign_sign.signed.signed_ref
  policy = jsonencode({
    apiVersion = "policy.sigstore.dev/v1beta1"
    kind       = "ClusterImagePolicy"
    metadata = {
      name = "image-is-signed"
    }
    spec = {
      images = [{
        glob = "${var.repo}/**"
      }]
      authorities = [{
        keyless = {
          url = "https://fulcio.sigstore.dev"
          identities = [{
            issuer  = "https://token.actions.githubusercontent.com"
            subject = "https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main"
          }]
        }
        ctlog = {
          url = "https://rekor.sigstore.dev"
        }
      }]
    }
  })
}

resource "google_cloud_run_service" "service" {
  name     = "tf-example-service"
  location = "us-central1"
  template {
    spec {
      containers {
        image = cosign_verify.verify.verified_ref
      }
    }
  }
  traffic {
    percent         = 100
    latest_revision = true
  }
}