-
Notifications
You must be signed in to change notification settings - Fork 1
251 lines (248 loc) · 12.6 KB
/
build-split-image.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
name: Build Split-Arch Image On Release
on:
workflow_call:
inputs:
target-arch:
required: true
type: string
repo_owner:
required: true
type: string
app_name:
required: true
type: string
release_type:
required: true
type: string
release_url:
required: false
type: string
release_name:
required: false
type: string
secrets:
OP_SERVICE_ACCOUNT_TOKEN:
required: true
jobs:
bake:
runs-on: ubuntu-22.04
if: ${{ github.actor != 'dependabot[bot]' }}
strategy:
matrix:
arch: ${{ fromJson(inputs.target-arch) }}
outputs:
meta-amd64: ${{ steps.dump_tags.outputs.meta-amd64 }}
meta-arm64v8: ${{ steps.dump_tags.outputs.meta-arm64v8 }}
steps:
-
name: Checkout
uses: actions/checkout@v4
-
name: Docker meta
id: docker_meta
uses: docker/metadata-action@v5.6.1
with:
images: |
ghcr.io/${{ inputs.repo_owner }}/${{ inputs.app_name }}
labels: |
org.opencontainers.image.title=${{ inputs.app_name }}
org.opencontainers.image.description=${{ inputs.app_name }}
org.opencontainers.image.vendor=${{ inputs.repo_owner }}
flavor: |
prefix=${{ matrix.arch }}-,onlatest=true
tags: |
type=schedule
type=ref,event=branch
type=ref,event=tag
type=ref,event=pr,prefix=${{ matrix.arch }}-pr-,enable=true,priority=600
type=raw,value=latest,enable={{is_default_branch}}
-
name: Set up QEMU
uses: docker/setup-qemu-action@v3
-
name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3.10.0
-
name: Login to GitHub Container Registry
uses: docker/login-action@v3.3.0
with:
registry: ghcr.io
username: ${{ inputs.repo_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
-
name: Generate build date
id: gen_date
run: |
BUILD_DATE=$(date '+%Y-%m-%dT%H:%M:%S%:z')
echo "**** Setting build date to $BUILD_DATE ****"
echo "build_date=${BUILD_DATE}" >> $GITHUB_OUTPUT
-
name: Generate release version
id: gen_release
run: |
if [ -z ${{ github.event.release.tag_name }} ]; then
IMAGE_VERSION=$(curl -s "https://api.github.com/repos/${{ inputs.repo_owner }}/docker-${{ inputs.app_name }}/releases" | jq -r '(sort_by(.published_at) | .[-1].tag_name)?')
if [ -z $IMAGE_VERSION ] || [ $IMAGE_VERSION == null ]; then
case ${{ inputs.release_type }} in
github)
IMAGE_VERSION=$(curl -sX GET "${{ inputs.release_url }}/releases/latest" | awk '/tag_name/{print $4;exit}' FS='[""]');
;;
github_tag)
IMAGE_VERSION=$(curl -sX GET "${{ inputs.release_url }}/tags" | jq -r 'first(.[] | select(.name | contains("${{ inputs.release_name }}") )) | .name');
;;
github_commit)
IMAGE_VERSION=$(curl -sL "${{ inputs.release_url }}" | jq -r 'first(.[])' | cut -c1-8);
;;
alpine)
IMAGE_VERSION=$(curl -sL "http://dl-cdn.alpinelinux.org/alpine/${{ inputs.release_url }}/x86_64/APKINDEX.tar.gz" | tar -xz -C /tmp && awk '/^P:'"${{ inputs.release_name }}"'$/,/V:/' /tmp/APKINDEX | sed -n 2p | sed 's/^V://');
;;
script)
if test -f "./get-version.sh"; then
IMAGE_VERSION=$(bash "./get-version.sh");
fi
;;
esac
fi
else
IMAGE_VERSION=${{ github.event.release.tag_name }}
fi
APP_VERSION=$(echo ${IMAGE_VERSION} | awk -F'-ls' '{print $1}')
echo "**** Setting release tag to $IMAGE_VERSION ****"
echo "tag_name=${IMAGE_VERSION}" >> $GITHUB_OUTPUT
echo "app_version=${APP_VERSION}" >> $GITHUB_OUTPUT
-
name: Build and push
uses: docker/bake-action@v5.11.0
with:
files: |
./docker-bake.hcl
${{ steps.docker_meta.outputs.bake-file }}
set: |
image.args.BUILD_DATE=${{ steps.gen_date.outputs.build_date }}
image.args.VERSION=${{ steps.gen_release.outputs.tag_name }}
image.args.APP_VERSION=${{ steps.gen_release.outputs.app_version }}
targets: ${{ matrix.arch }}
push: true
provenance: false
sbom: true
-
name: Dump Tags
id: dump_tags
run: |
echo "meta-${{ matrix.arch }}=${{ fromJSON(steps.docker_meta.outputs.json).tags[0] }}" >> $GITHUB_OUTPUT
manifest:
runs-on: ubuntu-22.04
if: ${{ github.actor != 'dependabot[bot]' }}
needs: bake
strategy:
matrix:
registry: ["ghcr.io"]
outputs:
final-image: ${{ steps.image_tags.outputs.final_image }}
steps:
-
name: Login to DockerHub
if: matrix.registry == 'docker.io'
uses: docker/login-action@v3.3.0
with:
username: ${{ inputs.dockerhub_user }}
password: ${{ secrets.dockerhub_password }}
-
name: Login to GitHub Container Registry
if: matrix.registry == 'ghcr.io'
uses: docker/login-action@v3.3.0
with:
registry: ghcr.io
username: ${{ inputs.repo_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
-
name: Install Cosign
uses: sigstore/cosign-installer@v3.8.1
-
name: Create image tags
id: image_tags
run: |
AMD64=$(echo ${{ needs.bake.outputs.meta-amd64 }} | cut -f 2- -d '/')
ARM64=$(echo ${{ needs.bake.outputs.meta-arm64v8 }} | cut -f 2- -d '/')
if [[ -n $AMD64 ]]; then TAG_NAME=$(echo ${{ needs.bake.outputs.meta-amd64 }} | cut -f 2- -d ':' | cut -f 2- -d '-'); AMD64="${{ matrix.registry }}/${AMD64}"; fi
if [[ -n $ARM64 ]]; then TAG_NAME=$(echo ${{ needs.bake.outputs.meta-arm64v8 }} | cut -f 2- -d ':' | cut -f 2- -d '-'); ARM64="${{ matrix.registry }}/${ARM64}"; fi
EXTRA_IMAGES=$(echo $AMD64 $ARM64 | tr ' ' ',')
echo "Extra images are: ${EXTRA_IMAGES}"
FINAL_IMAGE=ghcr.io/${{ inputs.repo_owner }}/${{ inputs.app_name }}:${TAG_NAME}
echo "extra_images=${EXTRA_IMAGES}" >> $GITHUB_OUTPUT
echo "tag_name=${TAG_NAME}" >> $GITHUB_OUTPUT
echo "final_image=${FINAL_IMAGE}" >> $GITHUB_OUTPUT
-
name: Load Key
id: op-load-key
uses: 1password/load-secrets-action@v2
with:
export-env: true
env:
OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
COSIGN_PRIVATE_KEY: op://Labs/labs-sigstore-key/notesPlain
COSIGN_PASSWORD: op://Labs/labs-sigstore-pass/password
-
name: Create manifest and sign image for release
if: ${{ github.event_name != 'pull_request' }}
id: manifest_sign
run: |
if [[ ${{ steps.image_tags.outputs.extra_images }} =~ "arm64v8" ]]; then
docker buildx imagetools create -t ${MANIFESTIMAGE}:latest ${MANIFESTIMAGE}:amd64-latest ${MANIFESTIMAGE}:arm64v8-latest
docker buildx imagetools create -t ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG}
else
docker buildx imagetools create -t ${MANIFESTIMAGE}:latest ${MANIFESTIMAGE}:amd64-latest
docker buildx imagetools create -t ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG}
fi
case "${{ matrix.registry }}" in
"ghcr.io") AUTH_URL="https://ghcr.io/token?scope=repository%3A${{ inputs.repo_owner }}%2F${{ inputs.app_name }}%3Apull"; REGISTRY="ghcr.io";;
"docker.io") AUTH_URL="https://auth.docker.io/token?service=registry.docker.io&scope=repository:${{ inputs.repo_owner }}/${{ inputs.app_name }}:pull"; REGISTRY="registry-1.docker.io";;
esac
TOKEN="$(curl -s -f --retry 10 --retry-max-time 60 --retry-connrefused "${AUTH_URL}" | jq -r '.token')"
IFS=',' read -r -a IMAGES <<< "${{ steps.image_tags.outputs.extra_images }}"
for i in "${IMAGES[@]}"; do
i=$(echo $i | cut -d":" -f2 | cut -d"-" -f1)
DIGEST=$(curl -s -L --retry 10 --retry-max-time 60 --retry-connrefused -I -H "Authorization: Bearer ${TOKEN}" --header "Accept: application/vnd.docker.distribution.manifest.v2+json" --header "Accept: application/vnd.oci.image.index.v1+json" https://${REGISTRY}/v2/${MANIFESTIMAGE}/manifests/${i}-latest 2>&1 | grep 'docker-content-digest' | cut -d' ' -f2)
DIGEST="${DIGEST//[$'\t\r\n ']}"
echo "Signing ${MANIFESTIMAGE}:${i}-${EXT_RELEASE_TAG} and ${MANIFESTIMAGE}:${i}-latest with digest ${DIGEST}"
cosign sign --yes --key env://COSIGN_PRIVATE_KEY ${MANIFESTIMAGE}:${i}-${EXT_RELEASE_TAG}@${DIGEST}
cosign sign --yes --key env://COSIGN_PRIVATE_KEY ${MANIFESTIMAGE}:${i}-latest@${DIGEST}
done
DIGEST=$(curl -s -L --retry 10 --retry-max-time 60 --retry-connrefused -I -H "Authorization: Bearer ${TOKEN}" --header "Accept: application/vnd.docker.distribution.manifest.v2+json" --header "Accept: application/vnd.oci.image.index.v1+json" https://${REGISTRY}/v2/${MANIFESTIMAGE}/manifests/latest 2>&1 | grep 'docker-content-digest' | cut -d' ' -f2)
DIGEST="${DIGEST//[$'\t\r\n ']}"
echo "Signing ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} and ${MANIFESTIMAGE}:latest with digest ${DIGEST}"
cosign sign --yes --key env://COSIGN_PRIVATE_KEY ${MANIFESTIMAGE}:${EXT_RELEASE_TAG}@${DIGEST}
cosign sign --yes --key env://COSIGN_PRIVATE_KEY ${MANIFESTIMAGE}:latest@${DIGEST}
env:
EXT_RELEASE_TAG: ${{ steps.image_tags.outputs.tag_name }}
MANIFESTIMAGE: ${{ matrix.registry }}/${{ inputs.repo_owner }}/${{ inputs.app_name }}
-
name: Create manifest and sign image for PRs
if: ${{ github.event_name == 'pull_request' }}
id: manifest_sign_pr
run: |
if [[ ${{ steps.image_tags.outputs.extra_images }} =~ "arm64v8" ]]; then
docker buildx imagetools create -t ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:arm64v8-${EXT_RELEASE_TAG}
else
docker buildx imagetools create -t ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} ${MANIFESTIMAGE}:amd64-${EXT_RELEASE_TAG}
fi
case "${{ matrix.registry }}" in
"ghcr.io") AUTH_URL="https://ghcr.io/token?scope=repository%3A${{ inputs.repo_owner }}%2F${{ inputs.app_name }}%3Apull"; REGISTRY="ghcr.io";;
"docker.io") AUTH_URL="https://auth.docker.io/token?service=registry.docker.io&scope=repository:${{ inputs.repo_owner }}/${{ inputs.app_name }}:pull"; REGISTRY="registry-1.docker.io";;
esac
TOKEN="$(curl -s -f --retry 10 --retry-max-time 60 --retry-connrefused "${AUTH_URL}" | jq -r '.token')"
IFS=',' read -r -a IMAGES <<< "${{ steps.image_tags.outputs.extra_images }}"
for i in "${IMAGES[@]}"; do
i=$(echo $i | cut -d":" -f2 | cut -d"-" -f1)
DIGEST=$(curl -s -L --retry 10 --retry-max-time 60 --retry-connrefused -I -H "Authorization: Bearer ${TOKEN}" --header "Accept: application/vnd.docker.distribution.manifest.v2+json" --header "Accept: application/vnd.oci.image.index.v1+json" https://${REGISTRY}/v2/${MANIFESTIMAGE}/manifests/${i}-${EXT_RELEASE_TAG} 2>&1 | grep 'docker-content-digest' | cut -d' ' -f2)
DIGEST="${DIGEST//[$'\t\r\n ']}"
echo "Signing ${MANIFESTIMAGE}:${i}-${EXT_RELEASE_TAG} with digest ${DIGEST}"
cosign sign --yes --key env://COSIGN_PRIVATE_KEY ${MANIFESTIMAGE}:${i}-${EXT_RELEASE_TAG}@${DIGEST}
done
DIGEST=$(curl -s -L --retry 10 --retry-max-time 60 --retry-connrefused -I -H "Authorization: Bearer ${TOKEN}" --header "Accept: application/vnd.docker.distribution.manifest.v2+json" --header "Accept: application/vnd.oci.image.index.v1+json" https://${REGISTRY}/v2/${MANIFESTIMAGE}/manifests/${EXT_RELEASE_TAG} 2>&1 | grep 'docker-content-digest' | cut -d' ' -f2)
DIGEST="${DIGEST//[$'\t\r\n ']}"
echo "Signing ${MANIFESTIMAGE}:${EXT_RELEASE_TAG} with digest ${DIGEST}"
cosign sign --yes --key env://COSIGN_PRIVATE_KEY ${MANIFESTIMAGE}:${EXT_RELEASE_TAG}@${DIGEST}
env:
EXT_RELEASE_TAG: ${{ steps.image_tags.outputs.tag_name }}
MANIFESTIMAGE: ${{ matrix.registry }}/${{ inputs.repo_owner }}/${{ inputs.app_name }}