From b72c69fc8ea444710d126e0b42b8745f577f36ec Mon Sep 17 00:00:00 2001 From: ThePhaseless Date: Wed, 26 Feb 2025 11:03:28 +0100 Subject: [PATCH] try new build action --- .github/workflows/docker-publish.yml | 163 +++++++++++++++++---------- 1 file changed, 106 insertions(+), 57 deletions(-) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 5290eb2..a94bfe9 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -23,33 +23,57 @@ env: IMAGE_NAME: ${{ github.repository }} jobs: - build: + test: runs-on: ubuntu-latest permissions: contents: read packages: write - # This is used to complete the identity challenge - # with sigstore/fulcio when running outside of PRs. id-token: write + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Test + id: test + uses: docker/build-push-action@v6 + with: + context: . + platforms: linux/amd64 + cache-from: type=gha,scope=buildkit-x64 + pull: true + cache-to: type=gha,mode=max,scope=buildkit-x64 + target: test + + build: + needs: test + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + id-token: write + + strategy: + matrix: + platform: [linux/amd64, linux/arm64] + steps: - name: Checkout repository uses: actions/checkout@v4 # Install the cosign tool except on PR - # https://github.com/sigstore/cosign-installer - name: Install cosign if: github.event_name != 'pull_request' uses: sigstore/cosign-installer@v3 - # Set up BuildKit Docker container builder to be able to build - # multi-platform images and export cache - # https://github.com/docker/setup-buildx-action + # Set up BuildKit Docker container builder - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 # Login against a Docker registry except on PR - # https://github.com/docker/login-action - name: Log into registry ${{ env.REGISTRY }} if: github.event_name != 'pull_request' uses: docker/login-action@v3 @@ -59,7 +83,6 @@ jobs: password: ${{ secrets.GITHUB_TOKEN }} # Extract metadata (tags, labels) for Docker - # https://github.com/docker/metadata-action - name: Extract Docker metadata id: meta uses: docker/metadata-action@v5 @@ -73,68 +96,94 @@ jobs: type=raw,enable=${{ github.ref_type == 'tag' }}, value=latest images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - - name: Test - id: test - uses: docker/build-push-action@v6 - with: - context: . - platforms: linux/amd64 - cache-from: type=gha,scope=buildkit-x64 - pull: true - cache-to: type=gha,mode=max,scope=buildkit-x64 - target: test + # Get platform specific variables + - name: Set platform-specific variables + id: platform-vars + run: | + PLATFORM="${{ matrix.platform }}" + PLATFORM_SUFFIX="${PLATFORM//\//-}" + echo "platform_suffix=${PLATFORM_SUFFIX}" >> $GITHUB_OUTPUT + echo "cache_scope=buildkit-${PLATFORM_SUFFIX}" >> $GITHUB_OUTPUT - - name: Build and push Docker image for arm64 - id: build-and-push-arm64 + # Build and push Docker image with platform-specific tag + - name: Build and push Docker image + id: build-and-push uses: docker/build-push-action@v6 with: context: . pull: true push: ${{ github.event_name != 'pull_request' }} - tags: ${{ steps.meta.outputs.tags }} + tags: ${{ steps.meta.outputs.tags }}-${{ steps.platform-vars.outputs.platform_suffix }} labels: ${{ steps.meta.outputs.labels }} - platforms: linux/arm64 - cache-from: type=gha,scope=buildkit-arm64 - cache-to: type=gha,mode=max,scope=buildkit-arm64 + platforms: ${{ matrix.platform }} + cache-from: type=gha,scope=${{ steps.platform-vars.outputs.cache_scope }} + cache-to: type=gha,mode=max,scope=${{ steps.platform-vars.outputs.cache_scope }} build-args: GITHUB_BUILD=true,VERSION=${{ github.ref_name }} - # Sign the resulting Docker image digest except on PRs. - # This will only write to the public Rekor transparency log when the Docker - # repository is public to avoid leaking data. If you would like to publish - # transparency data even for private images, pass --force to cosign below. - # https://github.com/sigstore/cosign - - name: Sign the published Docker image for arm64 + # Sign the platform specific image + - name: Sign the published Docker image if: ${{ github.event_name != 'pull_request' }} env: - # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable - TAGS: ${{ steps.meta.outputs.tags }} - DIGEST: ${{ steps.build-and-push-arm64.outputs.digest }} - # This step uses the identity token to provision an ephemeral certificate - # against the sigstore community Fulcio instance. + TAGS: ${{ steps.meta.outputs.tags }}-${{ steps.platform-vars.outputs.platform_suffix }} + DIGEST: ${{ steps.build-and-push.outputs.digest }} run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} - # Build and push Docker image with Buildx (don't push on PR) - # https://github.com/docker/build-push-action - - name: Build and push Docker image for x64 - id: build-and-push-x64 - uses: docker/build-push-action@v6 + merge: + needs: build + runs-on: ubuntu-latest + if: github.event_name != 'pull_request' + permissions: + contents: read + packages: write + id-token: write + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Log into registry ${{ env.REGISTRY }} + uses: docker/login-action@v3 with: - context: . - pull: true - push: ${{ github.event_name != 'pull_request' }} - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - platforms: linux/amd64 - cache-from: type=gha,scope=buildkit-x64 - cache-to: type=gha,mode=max,scope=buildkit-x64 - build-args: GITHUB_BUILD=true,VERSION=${{ github.ref_name }} + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} - - name: Sign the published Docker image for x64 - if: ${{ github.event_name != 'pull_request' }} + - name: Extract Docker metadata + id: meta + uses: docker/metadata-action@v5 + with: + tags: | + type=ref,event=branch + type=ref,event=pr + type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + type=semver,pattern={{major}} + type=raw,enable=${{ github.ref_type == 'tag' }}, value=latest + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + + - name: Install cosign + uses: sigstore/cosign-installer@v3 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Create and push manifest + run: | + TAGS="${{ steps.meta.outputs.tags }}" + for TAG in $TAGS; do + # Create manifest list and push it + docker buildx imagetools create -t $TAG \ + $TAG-linux-amd64 \ + $TAG-linux-arm64 + done + + - name: Install cosign + uses: sigstore/cosign-installer@v3 + + - name: Sign the manifest env: - # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable TAGS: ${{ steps.meta.outputs.tags }} - DIGEST: ${{ steps.build-and-push-x64.outputs.digest }} - # This step uses the identity token to provision an ephemeral certificate - # against the sigstore community Fulcio instance. - run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST} + run: | + for TAG in $TAGS; do + cosign sign --yes $TAG + done