From 72acdb2930ec822489d586f2e2a3000b0468c9e5 Mon Sep 17 00:00:00 2001 From: Philipp Geschke Date: Sun, 7 Jan 2024 18:05:39 +0100 Subject: [PATCH 01/11] Buildah building action --- .github/workflows/publish-container.yml | 129 ++++++++++++++++++++++++ 1 file changed, 129 insertions(+) create mode 100644 .github/workflows/publish-container.yml diff --git a/.github/workflows/publish-container.yml b/.github/workflows/publish-container.yml new file mode 100644 index 0000000..4f3ea61 --- /dev/null +++ b/.github/workflows/publish-container.yml @@ -0,0 +1,129 @@ +name: ghcr publish + +on: + workflow_dispatch: + push: + branches: [ "main" ] + # Publish semver tags as releases. + tags: [ 'v*.*.*' ] + pull_request: + branches: [ "main" ] + +env: + # Use docker.io for Docker Hub if empty + REGISTRY: ghcr.io + # github.repository as / + IMAGE_NAME: pgschk/alpine-tookit + TEST_TAG: test + +jobs: + build: + strategy: + fail-fast: false + matrix: + install_latest: [ true, false ] + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + # This is used to complete the identity challenge + # with sigstore/fulcio when running outside of PRs. + id-token: write + + steps: + - name: Checkout repository + uses: actions/checkout@v3 + + # Install the cosign tool except on PR + # https://github.com/sigstore/cosign-installer + - name: Install cosign + if: github.event_name != 'pull_request' + uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1 + with: + cosign-release: 'v2.1.1' + + - name: Docker Metadata + id: docker-metadata + uses: docker/metadata-action@v4 + with: + images: | + ${{ env.IMAGE_NAME }} + tags: | + type=edge + type=sha + type=ref,event=branch + type=ref,event=pr + type=schedule + type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + type=semver,pattern={{major}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.') }} + + - name: Install latest buildah + if: matrix.install_latest + run: | + bash .github/install_latest_buildah.sh + + - name: Read extended packages file + id: get-extended-packages + run: echo "extended-packages=$(tr '\n' ' ' < EXTENDED_PACKAGES)" >> $GITHUB_OUTPUT + + # Build image using Buildah action + - name: Build Image + id: build_image + uses: ./ + with: + layers: false + tags: ${{ steps.docker-metadata.outputs.tags }} + labels: ${{ steps.docker-metadata.outputs.labels }} + containerfiles: | + ./Dockerfile + extra-args: | + --pull + + - name: Echo Outputs + run: | + echo "Image: ${{ steps.build_image.outputs.image }}" + echo "Tags: ${{ steps.build_image.outputs.tags }}" + echo "Tagged Image: ${{ steps.build_image.outputs.image-with-tag }}" + + # Check if image is build + - name: Check images created + run: buildah images | grep '${{ env.IMAGE_NAME }}' + + - name: Check image metadata + run: | + set -x + buildah inspect ${{ steps.build_image.outputs.image-with-tag }} | jq '.OCIv1.config.Labels."org.opencontainers.image.title"' + buildah inspect ${{ steps.build_image.outputs.image-with-tag }} | jq '.OCIv1.config.Labels."org.opencontainers.image.description"' + buildah inspect ${{ steps.build_image.outputs.image-with-tag }} | jq '.Docker.config.Labels."org.opencontainers.image.title"' + buildah inspect ${{ steps.build_image.outputs.image-with-tag }} | jq '.Docker.config.Labels."org.opencontainers.image.description"' + + # Podman Login action (https://github.com/redhat-actions/podman-login) also be used to log in, + # in which case 'username' and 'password' can be omitted. + - name: Push To ghcr.io + id: push-to-ghcr + if: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/main' }} + uses: redhat-actions/push-to-registry@v2 + with: + image: ${{ steps.build_image.outputs.image }} + tags: ${{ steps.build_image.outputs.tags }} + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Print ghcr.io image url + if: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/main' }} + run: echo "Image pushed to ${{ steps.push-to-ghcr.outputs.registry-paths }}" + + # Sign the resulting Docker image digest except on PRs. + # This will only write to the public Rekor transparency log when the Docker + # repository is public to avoid leaking data. If you would like to publish + # transparency data even for private images, pass --force to cosign below. + # https://github.com/sigstore/cosign + - name: Sign the published Docker image + if: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/main' }} + env: + COSIGN_EXPERIMENTAL: "true" + # This step uses the identity token to provision an ephemeral certificate + # against the sigstore community Fulcio instance. + run: echo "${{ steps.docker-metadata.outputs.tags }}" | xargs -I {} cosign sign --yes {}@${{ steps.build_image.outputs.digest }} From 969a1d1af2d0142cea47ec5553664224648fe505 Mon Sep 17 00:00:00 2001 From: Philipp Geschke Date: Sun, 7 Jan 2024 18:07:45 +0100 Subject: [PATCH 02/11] Remove install buildah step --- .github/workflows/publish-container.yml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/.github/workflows/publish-container.yml b/.github/workflows/publish-container.yml index 4f3ea61..4a6ca1d 100644 --- a/.github/workflows/publish-container.yml +++ b/.github/workflows/publish-container.yml @@ -20,8 +20,6 @@ jobs: build: strategy: fail-fast: false - matrix: - install_latest: [ true, false ] runs-on: ubuntu-latest permissions: contents: read @@ -58,11 +56,6 @@ jobs: type=semver,pattern={{major}}.{{minor}} type=semver,pattern={{major}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.') }} - - name: Install latest buildah - if: matrix.install_latest - run: | - bash .github/install_latest_buildah.sh - - name: Read extended packages file id: get-extended-packages run: echo "extended-packages=$(tr '\n' ' ' < EXTENDED_PACKAGES)" >> $GITHUB_OUTPUT From 94f32dd8ed984e788d7dfba03164732ee198e920 Mon Sep 17 00:00:00 2001 From: Philipp Geschke Date: Sun, 7 Jan 2024 18:22:02 +0100 Subject: [PATCH 03/11] Update buildah workflow --- .github/workflows/publish-container.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish-container.yml b/.github/workflows/publish-container.yml index 4a6ca1d..9df136f 100644 --- a/.github/workflows/publish-container.yml +++ b/.github/workflows/publish-container.yml @@ -63,7 +63,7 @@ jobs: # Build image using Buildah action - name: Build Image id: build_image - uses: ./ + uses: redhat-actions/buildah-build@v2 with: layers: false tags: ${{ steps.docker-metadata.outputs.tags }} From ae5e021ef1e7252dbb304e69c01d44aa7f9c4469 Mon Sep 17 00:00:00 2001 From: Philipp Geschke Date: Sun, 7 Jan 2024 18:29:16 +0100 Subject: [PATCH 04/11] Add CTR --- .github/workflows/publish-container.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/publish-container.yml b/.github/workflows/publish-container.yml index 9df136f..07053ce 100644 --- a/.github/workflows/publish-container.yml +++ b/.github/workflows/publish-container.yml @@ -73,6 +73,14 @@ jobs: extra-args: | --pull + # Run container-structure-test + # https://github.com/marketplace/actions/container-structure-test-action + - name: Run container-structure-tests + uses: plexsystems/container-structure-test-action@v0.3.0 + with: + image: ${{ steps.docker-metadata.outputs.tags[0] }} + config: test/container-structure-test/tests.yml + - name: Echo Outputs run: | echo "Image: ${{ steps.build_image.outputs.image }}" From ffcef5af5d729295cc8401bcf09d60f7e75b92dc Mon Sep 17 00:00:00 2001 From: Philipp Geschke Date: Sun, 7 Jan 2024 18:31:06 +0100 Subject: [PATCH 05/11] Update buildah workflow --- .github/workflows/publish-container.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/publish-container.yml b/.github/workflows/publish-container.yml index 07053ce..807f731 100644 --- a/.github/workflows/publish-container.yml +++ b/.github/workflows/publish-container.yml @@ -73,14 +73,6 @@ jobs: extra-args: | --pull - # Run container-structure-test - # https://github.com/marketplace/actions/container-structure-test-action - - name: Run container-structure-tests - uses: plexsystems/container-structure-test-action@v0.3.0 - with: - image: ${{ steps.docker-metadata.outputs.tags[0] }} - config: test/container-structure-test/tests.yml - - name: Echo Outputs run: | echo "Image: ${{ steps.build_image.outputs.image }}" @@ -99,6 +91,14 @@ jobs: buildah inspect ${{ steps.build_image.outputs.image-with-tag }} | jq '.Docker.config.Labels."org.opencontainers.image.title"' buildah inspect ${{ steps.build_image.outputs.image-with-tag }} | jq '.Docker.config.Labels."org.opencontainers.image.description"' + # Run container-structure-test + # https://github.com/marketplace/actions/container-structure-test-action + - name: Run container-structure-tests + uses: plexsystems/container-structure-test-action@v0.3.0 + with: + image: ${{ steps.build_image.outputs.image-with-tag }} + config: test/container-structure-test/tests.yml + # Podman Login action (https://github.com/redhat-actions/podman-login) also be used to log in, # in which case 'username' and 'password' can be omitted. - name: Push To ghcr.io From df8dc40989eee0ac75ce44cb8a2dc6990c65c765 Mon Sep 17 00:00:00 2001 From: Philipp Geschke Date: Sun, 7 Jan 2024 18:31:36 +0100 Subject: [PATCH 06/11] Remove obsolete workflow --- .github/workflows/ghcr-publish.yml | 135 ----------------------------- 1 file changed, 135 deletions(-) delete mode 100644 .github/workflows/ghcr-publish.yml diff --git a/.github/workflows/ghcr-publish.yml b/.github/workflows/ghcr-publish.yml deleted file mode 100644 index b0549c5..0000000 --- a/.github/workflows/ghcr-publish.yml +++ /dev/null @@ -1,135 +0,0 @@ -name: ghcr publish - -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -on: - push: - branches: [ "main" ] - # Publish semver tags as releases. - tags: [ 'v*.*.*' ] - pull_request: - branches: [ "main" ] - -env: - # Use docker.io for Docker Hub if empty - REGISTRY: ghcr.io - # github.repository as / - IMAGE_NAME: pgschk/alpine-tookit - TEST_TAG: test - -jobs: - build: - - runs-on: ubuntu-latest - permissions: - contents: read - packages: write - # This is used to complete the identity challenge - # with sigstore/fulcio when running outside of PRs. - id-token: write - - steps: - - name: Checkout repository - uses: actions/checkout@v3 - - # Install the cosign tool except on PR - # https://github.com/sigstore/cosign-installer - - name: Install cosign - if: github.event_name != 'pull_request' - uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1 - with: - cosign-release: 'v2.1.1' - - # Workaround: https://github.com/docker/build-push-action/issues/461 - - name: Setup Docker buildx - uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 - - # Login against a Docker registry except on PR - # https://github.com/docker/login-action - - name: Log into registry ${{ env.REGISTRY }} - if: github.event_name != 'pull_request' - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d - with: - registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - # Extract metadata (tags, labels) for Docker - # https://github.com/docker/metadata-action - - name: Extract Docker metadata - id: meta - uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 - with: - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - - # Extract metadata (tags, labels) for Docker - # https://github.com/docker/metadata-action - - name: Extract Docker metadata extended - id: meta-extended - uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 - with: - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - flavor: | - latest=auto - suffix=-extended,onlatest=true - - - name: Read extended packages file - id: get-extended-packages - run: echo "extended-packages=$(tr '\n' ' ' < EXTENDED_PACKAGES)" >> $GITHUB_OUTPUT - - # Build and push Docker image with Buildx (don't push on PR) - # https://github.com/docker/build-push-action - - name: Build and push Docker image - id: build-and-push - uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 - with: - context: . - push: ${{ github.event_name != 'pull_request' }} - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha - cache-to: type=gha,mode=max - - # Build and push Docker image with Buildx (don't push on PR) - # https://github.com/docker/build-push-action - - name: Build and push extended Docker image - id: build-and-push-extended - uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 - with: - context: . - build-args: | - EXTRA_PACKAGES=${{ steps.get-extended-packages.outputs.extended-packages }} - push: ${{ github.event_name != 'pull_request' }} - tags: ${{ steps.meta-extended.outputs.tags }} - labels: ${{ steps.meta-extended.outputs.labels }} - cache-from: type=gha - cache-to: type=gha,mode=max - - # Sign the resulting Docker image digest except on PRs. - # This will only write to the public Rekor transparency log when the Docker - # repository is public to avoid leaking data. If you would like to publish - # transparency data even for private images, pass --force to cosign below. - # https://github.com/sigstore/cosign - - name: Sign the published Docker image - if: ${{ github.event_name != 'pull_request' }} - env: - COSIGN_EXPERIMENTAL: "true" - # This step uses the identity token to provision an ephemeral certificate - # against the sigstore community Fulcio instance. - run: echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign sign --yes {}@${{ steps.build-and-push.outputs.digest }} - - # Sign the resulting Docker image digest except on PRs. - # This will only write to the public Rekor transparency log when the Docker - # repository is public to avoid leaking data. If you would like to publish - # transparency data even for private images, pass --force to cosign below. - # https://github.com/sigstore/cosign - - name: Sign the published extended Docker image - if: ${{ github.event_name != 'pull_request' }} - env: - COSIGN_EXPERIMENTAL: "true" - # This step uses the identity token to provision an ephemeral certificate - # against the sigstore community Fulcio instance. - run: echo "${{ steps.meta-extended.outputs.tags }}" | xargs -I {} cosign sign --yes {}@${{ steps.build-and-push.outputs.digest }} \ No newline at end of file From adb3ec593d4098ea6efef3f492361a5a0b77fadf Mon Sep 17 00:00:00 2001 From: Philipp Geschke Date: Sun, 7 Jan 2024 18:39:09 +0100 Subject: [PATCH 07/11] Update image name --- .github/workflows/publish-container.yml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish-container.yml b/.github/workflows/publish-container.yml index 807f731..3e85440 100644 --- a/.github/workflows/publish-container.yml +++ b/.github/workflows/publish-container.yml @@ -13,7 +13,9 @@ env: # Use docker.io for Docker Hub if empty REGISTRY: ghcr.io # github.repository as / - IMAGE_NAME: pgschk/alpine-tookit + IMAGES: | + docker.io/pgschk/alpine-toolkit + ghcr.io/pgschk/alpine-toolkit TEST_TAG: test jobs: @@ -45,7 +47,7 @@ jobs: uses: docker/metadata-action@v4 with: images: | - ${{ env.IMAGE_NAME }} + ${{ env.IMAGES }} tags: | type=edge type=sha @@ -81,7 +83,7 @@ jobs: # Check if image is build - name: Check images created - run: buildah images | grep '${{ env.IMAGE_NAME }}' + run: buildah images | grep '${{ env.IMAGES }}' - name: Check image metadata run: | @@ -127,4 +129,4 @@ jobs: COSIGN_EXPERIMENTAL: "true" # This step uses the identity token to provision an ephemeral certificate # against the sigstore community Fulcio instance. - run: echo "${{ steps.docker-metadata.outputs.tags }}" | xargs -I {} cosign sign --yes {}@${{ steps.build_image.outputs.digest }} + run: echo "${{ steps.docker-metadata.outputs.tags }}" | xargs -I {} cosign sign --yes {}@${{ steps.build_image.outputs.image-with-tag }} From 9c8eafa0342a2a8111acb16b93f6a84adf38af77 Mon Sep 17 00:00:00 2001 From: Philipp Geschke Date: Sun, 7 Jan 2024 19:34:17 +0100 Subject: [PATCH 08/11] Export buildah -> docker --- .github/workflows/publish-container.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/publish-container.yml b/.github/workflows/publish-container.yml index 3e85440..d12cdc6 100644 --- a/.github/workflows/publish-container.yml +++ b/.github/workflows/publish-container.yml @@ -93,6 +93,10 @@ jobs: buildah inspect ${{ steps.build_image.outputs.image-with-tag }} | jq '.Docker.config.Labels."org.opencontainers.image.title"' buildah inspect ${{ steps.build_image.outputs.image-with-tag }} | jq '.Docker.config.Labels."org.opencontainers.image.description"' + - name: Export image to docker + run: | + buildah push ${{ steps.build_image.outputs.image-with-tag }} docker-daemon:${{ steps.build_image.outputs.image-with-tag }} + # Run container-structure-test # https://github.com/marketplace/actions/container-structure-test-action - name: Run container-structure-tests From 13f1318f5570a1500d91d0e94d0147b95602a37b Mon Sep 17 00:00:00 2001 From: Philipp Geschke Date: Sun, 7 Jan 2024 21:15:08 +0100 Subject: [PATCH 09/11] Remove container structure tests --- .github/workflows/publish-container.yml | 8 -------- 1 file changed, 8 deletions(-) diff --git a/.github/workflows/publish-container.yml b/.github/workflows/publish-container.yml index d12cdc6..f394fa2 100644 --- a/.github/workflows/publish-container.yml +++ b/.github/workflows/publish-container.yml @@ -97,14 +97,6 @@ jobs: run: | buildah push ${{ steps.build_image.outputs.image-with-tag }} docker-daemon:${{ steps.build_image.outputs.image-with-tag }} - # Run container-structure-test - # https://github.com/marketplace/actions/container-structure-test-action - - name: Run container-structure-tests - uses: plexsystems/container-structure-test-action@v0.3.0 - with: - image: ${{ steps.build_image.outputs.image-with-tag }} - config: test/container-structure-test/tests.yml - # Podman Login action (https://github.com/redhat-actions/podman-login) also be used to log in, # in which case 'username' and 'password' can be omitted. - name: Push To ghcr.io From 533eaa3ee3e323dde00f9bd44b9c4034128869b3 Mon Sep 17 00:00:00 2001 From: Philipp Geschke Date: Sun, 7 Jan 2024 21:38:25 +0100 Subject: [PATCH 10/11] Update Container workflow --- .github/workflows/publish-container.yml | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/.github/workflows/publish-container.yml b/.github/workflows/publish-container.yml index f394fa2..ed3e57e 100644 --- a/.github/workflows/publish-container.yml +++ b/.github/workflows/publish-container.yml @@ -1,4 +1,4 @@ -name: ghcr publish +name: Container CI on: workflow_dispatch: @@ -10,13 +10,9 @@ on: branches: [ "main" ] env: - # Use docker.io for Docker Hub if empty - REGISTRY: ghcr.io - # github.repository as / IMAGES: | docker.io/pgschk/alpine-toolkit ghcr.io/pgschk/alpine-toolkit - TEST_TAG: test jobs: build: @@ -97,6 +93,19 @@ jobs: run: | buildah push ${{ steps.build_image.outputs.image-with-tag }} docker-daemon:${{ steps.build_image.outputs.image-with-tag }} + - name: Log in to docker.io + uses: redhat-actions/podman-login@v1 + with: + registry: docker.io + username: ${{ github.actor }} + password: ${{ secrets.DOCKER_LOGIN }} + - name: Log in to ghcr.io + uses: redhat-actions/podman-login@v1 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + # Podman Login action (https://github.com/redhat-actions/podman-login) also be used to log in, # in which case 'username' and 'password' can be omitted. - name: Push To ghcr.io @@ -106,9 +115,6 @@ jobs: with: image: ${{ steps.build_image.outputs.image }} tags: ${{ steps.build_image.outputs.tags }} - registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - name: Print ghcr.io image url if: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/main' }} From 5cb8f28f60a0779d4a8e9cfc21ed0346e09b7dde Mon Sep 17 00:00:00 2001 From: Philipp Geschke Date: Sun, 7 Jan 2024 21:40:37 +0100 Subject: [PATCH 11/11] Remove obsolete workflow --- .github/workflows/docker-publish.yml | 136 --------------------------- 1 file changed, 136 deletions(-) delete mode 100644 .github/workflows/docker-publish.yml diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml deleted file mode 100644 index 0768db5..0000000 --- a/.github/workflows/docker-publish.yml +++ /dev/null @@ -1,136 +0,0 @@ -name: Docker publish - -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -on: - push: - branches: [ "main" ] - # Publish semver tags as releases. - tags: [ 'v*.*.*' ] - pull_request: - branches: [ "main" ] - -env: - # Use docker.io for Docker Hub if empty - REGISTRY: docker.io - # github.repository as / - IMAGE_NAME: pgschk/alpine-toolkit - TEST_TAG: test - -jobs: - build: - - runs-on: ubuntu-latest - permissions: - contents: read - packages: write - # This is used to complete the identity challenge - # with sigstore/fulcio when running outside of PRs. - id-token: write - - steps: - - - name: Checkout repository - uses: actions/checkout@v3 - - # Install the cosign tool except on PR - # https://github.com/sigstore/cosign-installer - - name: Install cosign - if: github.event_name != 'pull_request' - uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1 - with: - cosign-release: 'v2.1.1' - - # Workaround: https://github.com/docker/build-push-action/issues/461 - - name: Setup Docker buildx - uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 - - # Login against a Docker registry except on PR - # https://github.com/docker/login-action - - name: Log into registry ${{ env.REGISTRY }} - if: github.event_name != 'pull_request' - uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d - with: - registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.DOCKER_LOGIN }} - - # Extract metadata (tags, labels) for Docker - # https://github.com/docker/metadata-action - - name: Extract Docker metadata - id: meta - uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 - with: - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - - # Extract metadata (tags, labels) for Docker - # https://github.com/docker/metadata-action - - name: Extract Docker metadata extended - id: meta-extended - uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 - with: - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - flavor: | - latest=auto - suffix=-extended,onlatest=true - - - name: Read extended packages file - id: get-extended-packages - run: echo "extended-packages=$(tr '\n' ' ' < EXTENDED_PACKAGES)" >> $GITHUB_OUTPUT - - # Build and push Docker image with Buildx (don't push on PR) - # https://github.com/docker/build-push-action - - name: Build and push Docker image - id: build-and-push - uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 - with: - context: . - push: ${{ github.event_name != 'pull_request' }} - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha - cache-to: type=gha,mode=max - - # Build and push Docker image with Buildx (don't push on PR) - # https://github.com/docker/build-push-action - - name: Build and push extended Docker image - id: build-and-push-extended - uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 - with: - context: . - build-args: | - EXTRA_PACKAGES=${{ steps.get-extended-packages.outputs.extended-packages }} - push: ${{ github.event_name != 'pull_request' }} - tags: ${{ steps.meta-extended.outputs.tags }} - labels: ${{ steps.meta-extended.outputs.labels }} - cache-from: type=gha - cache-to: type=gha,mode=max - - # Sign the resulting Docker image digest except on PRs. - # This will only write to the public Rekor transparency log when the Docker - # repository is public to avoid leaking data. If you would like to publish - # transparency data even for private images, pass --force to cosign below. - # https://github.com/sigstore/cosign - - name: Sign the published Docker image - if: ${{ github.event_name != 'pull_request' }} - env: - COSIGN_EXPERIMENTAL: "true" - # This step uses the identity token to provision an ephemeral certificate - # against the sigstore community Fulcio instance. - run: echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign sign --yes {}@${{ steps.build-and-push.outputs.digest }} - - # Sign the resulting Docker image digest except on PRs. - # This will only write to the public Rekor transparency log when the Docker - # repository is public to avoid leaking data. If you would like to publish - # transparency data even for private images, pass --force to cosign below. - # https://github.com/sigstore/cosign - - name: Sign the published extended Docker image - if: ${{ github.event_name != 'pull_request' }} - env: - COSIGN_EXPERIMENTAL: "true" - # This step uses the identity token to provision an ephemeral certificate - # against the sigstore community Fulcio instance. - run: echo "${{ steps.meta-extended.outputs.tags }}" | xargs -I {} cosign sign --yes {}@${{ steps.build-and-push.outputs.digest }} \ No newline at end of file