zabbix-docker/.github/workflows/images_build.yml

1055 lines
41 KiB
YAML
Raw Normal View History

2021-09-14 17:37:31 +02:00
name: Build images (DockerHub)
2021-09-13 19:36:12 +02:00
on:
release:
types:
- published
push:
branches:
2024-02-10 09:37:21 +01:00
- '[0-9]+.[0-9]+'
2021-09-13 19:36:12 +02:00
- 'trunk'
2021-10-08 00:13:22 +02:00
paths:
- 'Dockerfiles/**'
2021-10-28 02:05:53 +02:00
- 'build.json'
2021-10-16 00:11:57 +02:00
- '!**/README.md'
2021-10-08 00:13:22 +02:00
- '!Dockerfiles/*/rhel/*'
- '!Dockerfiles/*/windows/*'
- '.github/workflows/images_build.yml'
2024-02-10 15:04:06 +01:00
schedule:
2024-02-11 10:07:29 +01:00
- cron: '50 02 * * *'
2024-02-10 15:04:06 +01:00
workflow_dispatch:
2021-09-13 19:36:12 +02:00
defaults:
run:
shell: bash
2024-02-11 16:49:23 +01:00
permissions:
contents: read
2021-09-14 11:41:09 +02:00
env:
2024-02-10 15:04:06 +01:00
TRUNK_ONLY_EVENT: ${{ contains(fromJSON('["schedule"]'), github.event_name) }}
2024-02-17 15:11:32 +01:00
AUTO_PUSH_IMAGES: ${{ ! contains(fromJSON('["workflow_dispatch"]'), github.event_name) && vars.AUTO_PUSH_IMAGES }}
2024-02-09 18:40:10 +01:00
2024-05-30 13:36:54 +02:00
DOCKER_REGISTRY: ${{ vars.DOCKER_REGISTRY }}
2024-02-10 09:37:21 +01:00
DOCKER_REPOSITORY: ${{ vars.DOCKER_REPOSITORY }}
2021-09-14 11:41:09 +02:00
LATEST_BRANCH: ${{ github.event.repository.default_branch }}
2024-02-10 15:04:06 +01:00
TRUNK_GIT_BRANCH: "refs/heads/trunk"
2024-02-10 09:37:21 +01:00
IMAGES_PREFIX: "zabbix-"
2024-02-09 18:40:10 +01:00
2021-09-14 12:32:06 +02:00
BASE_BUILD_NAME: "build-base"
2024-02-19 06:57:53 +01:00
BASE_CACHE_FILE_NAME: "base_image_metadata.json"
BUILD_CACHE_FILE_NAME: "base_build_image_metadata.json"
2024-02-09 18:40:10 +01:00
2024-02-07 18:51:30 +01:00
MATRIX_FILE: "build.json"
2024-02-08 05:16:27 +01:00
DOCKERFILES_DIRECTORY: "./Dockerfiles"
2021-09-14 11:41:09 +02:00
2024-02-09 07:54:24 +01:00
OIDC_ISSUER: "https://token.actions.githubusercontent.com"
2024-02-19 06:57:53 +01:00
IDENTITY_REGEX: "https://github.com/zabbix/zabbix-docker/.github/"
2024-02-09 07:54:24 +01:00
2024-02-18 07:11:56 +01:00
DOCKER_REGISTRY_TEST: "ghcr.io"
DOCKER_REPOSITORY_TEST: "zabbix"
2021-09-13 19:36:12 +02:00
jobs:
2021-09-14 02:17:14 +02:00
init_build:
name: Initialize build
runs-on: ubuntu-latest
2024-02-08 05:35:09 +01:00
permissions:
contents: read
2021-09-14 02:17:14 +02:00
outputs:
2021-09-14 03:10:41 +02:00
os: ${{ steps.os.outputs.list }}
database: ${{ steps.database.outputs.list }}
components: ${{ steps.components.outputs.list }}
2021-10-18 18:12:43 +02:00
is_default_branch: ${{ steps.branch_info.outputs.is_default_branch }}
2024-02-07 18:51:30 +01:00
current_branch: ${{ steps.branch_info.outputs.current_branch }}
2024-02-08 16:44:14 +01:00
sha_short: ${{ steps.branch_info.outputs.sha_short }}
2021-09-14 02:17:14 +02:00
steps:
2024-02-08 05:16:27 +01:00
- name: Block egress traffic
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
2024-02-07 15:45:06 +01:00
with:
2024-02-08 05:16:27 +01:00
disable-sudo: true
egress-policy: block
allowed-endpoints: >
2024-02-17 18:22:59 +01:00
api.github.com:443
2024-02-08 05:16:27 +01:00
github.com:443
2024-02-17 18:24:04 +01:00
objects.githubusercontent.com:443
2024-02-07 15:45:06 +01:00
2021-09-14 12:32:06 +02:00
- name: Checkout repository
2024-07-08 12:31:41 +02:00
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
2021-09-14 11:41:09 +02:00
with:
2024-02-10 15:04:06 +01:00
ref: ${{ env.TRUNK_ONLY_EVENT == 'true' && env.TRUNK_GIT_BRANCH || '' }}
2021-09-14 11:41:09 +02:00
fetch-depth: 1
2024-02-07 18:53:43 +01:00
sparse-checkout: ${{ env.MATRIX_FILE }}
2021-09-14 11:41:09 +02:00
2024-02-09 18:40:10 +01:00
- name: Check ${{ env.MATRIX_FILE }} file
2021-09-14 12:32:06 +02:00
id: build_exists
2024-02-08 17:59:21 +01:00
env:
MATRIX_FILE: ${{ env.MATRIX_FILE }}
2021-09-14 03:10:41 +02:00
run: |
2024-02-08 17:59:21 +01:00
if [[ ! -f "$MATRIX_FILE" ]]; then
echo "::error::File $MATRIX_FILE is missing"
2021-09-14 12:32:06 +02:00
exit 1
2021-09-14 11:41:09 +02:00
fi
2021-09-14 12:32:06 +02:00
- name: Prepare Operating System list
id: os
2024-02-08 17:59:21 +01:00
env:
MATRIX_FILE: ${{ env.MATRIX_FILE }}
2021-09-14 12:32:06 +02:00
run: |
2024-02-14 09:25:33 +01:00
os_list=$(jq -r '.["os-linux"] | keys | map(select(. != "rhel")) | [ .[] | tostring ] | @json' "$MATRIX_FILE")
2021-09-14 12:32:06 +02:00
2024-02-09 18:40:10 +01:00
echo "::group::Operating System List"
echo "$os_list"
echo "::endgroup::"
2023-02-08 09:41:04 +01:00
echo "list=$os_list" >> $GITHUB_OUTPUT
2021-09-14 03:10:41 +02:00
2021-09-14 12:32:06 +02:00
- name: Prepare Database engine list
2021-09-14 03:10:41 +02:00
id: database
2024-02-08 17:59:21 +01:00
env:
MATRIX_FILE: ${{ env.MATRIX_FILE }}
2021-09-14 03:10:41 +02:00
run: |
2024-02-14 09:25:33 +01:00
database_list=$(jq -r '[.components | values[].base ] | sort | unique | del(.. | select ( . == "" ) ) | @json' "$MATRIX_FILE")
2021-09-14 12:32:06 +02:00
2024-02-09 18:40:10 +01:00
echo "::group::Database List"
echo "$database_list"
echo "::endgroup::"
2023-02-08 09:41:04 +01:00
echo "list=$database_list" >> $GITHUB_OUTPUT
2021-09-14 03:10:41 +02:00
2021-09-14 12:32:06 +02:00
- name: Prepare Zabbix component list
2021-09-14 03:10:41 +02:00
id: components
2024-02-08 17:59:21 +01:00
env:
MATRIX_FILE: ${{ env.MATRIX_FILE }}
2021-09-14 03:10:41 +02:00
run: |
2024-02-14 09:25:33 +01:00
component_list=$(jq -r '.components | keys | @json' "$MATRIX_FILE")
2021-09-14 12:32:06 +02:00
2024-02-09 18:40:10 +01:00
echo "::group::Zabbix Component List"
echo "$component_list"
echo "::endgroup::"
2023-02-08 09:41:04 +01:00
echo "list=$component_list" >> $GITHUB_OUTPUT
2021-09-14 03:10:41 +02:00
2021-10-08 00:13:22 +02:00
- name: Get branch info
id: branch_info
2024-02-08 17:59:21 +01:00
env:
LATEST_BRANCH: ${{ env.LATEST_BRANCH }}
2024-02-10 15:04:06 +01:00
github_ref: ${{ env.TRUNK_ONLY_EVENT == 'true' && env.TRUNK_GIT_BRANCH || github.ref }}
2021-10-18 18:12:43 +02:00
run: |
result=false
2024-02-09 18:40:10 +01:00
sha_short=$(git rev-parse --short HEAD)
2021-10-18 18:12:43 +02:00
if [[ "$github_ref" == "refs/tags/"* ]]; then
github_ref=${github_ref%.*}
fi
github_ref=${github_ref##*/}
2024-02-08 17:59:21 +01:00
if [[ "$github_ref" == "$LATEST_BRANCH" ]]; then
2021-10-18 18:12:43 +02:00
result=true
fi
2024-02-08 07:56:34 +01:00
2024-02-09 18:40:10 +01:00
echo "::group::Branch data"
echo "is_default_branch - $result"
echo "current_branch - $github_ref"
echo "sha_short - $sha_short"
echo "::endgroup::"
2024-02-07 18:51:30 +01:00
echo "is_default_branch=$result" >> $GITHUB_OUTPUT
echo "current_branch=$github_ref" >> $GITHUB_OUTPUT
2024-02-09 18:40:10 +01:00
echo "sha_short=$sha_short" >> $GITHUB_OUTPUT
2021-10-08 00:13:22 +02:00
2021-09-13 19:36:12 +02:00
build_base:
2021-10-29 03:16:24 +02:00
timeout-minutes: 30
2021-09-14 12:32:06 +02:00
name: Build base on ${{ matrix.os }}
2021-09-14 02:18:47 +02:00
needs: init_build
2021-09-13 19:36:12 +02:00
strategy:
2021-09-14 03:10:41 +02:00
fail-fast: false
2021-09-13 19:36:12 +02:00
matrix:
2021-09-14 02:17:14 +02:00
os: ${{ fromJson(needs.init_build.outputs.os) }}
2021-09-13 19:36:12 +02:00
2021-09-14 03:10:41 +02:00
runs-on: ubuntu-latest
2024-02-08 05:16:27 +01:00
permissions:
contents: read
2024-02-08 08:43:43 +01:00
id-token: write
2024-02-18 04:19:37 +01:00
packages: write
2024-05-30 13:36:54 +02:00
attestations: write
2021-09-13 19:36:12 +02:00
steps:
2024-02-07 19:32:12 +01:00
- name: Block egress traffic
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
2024-02-07 15:45:06 +01:00
with:
2024-02-08 05:35:09 +01:00
disable-sudo: true
egress-policy: audit
2024-02-08 05:35:09 +01:00
allowed-endpoints: >
api.github.com:443
archive.ubuntu.com:80
2024-02-10 09:37:21 +01:00
atl.mirrors.knownhost.com:443
atl.mirrors.knownhost.com:80
2024-02-08 10:36:35 +01:00
auth.docker.io:443
2024-02-08 05:37:02 +01:00
cdn03.quay.io:443
2024-02-08 07:56:34 +01:00
centos-stream-distro.1gservers.com:443
centos-stream-distro.1gservers.com:80
2024-02-10 09:37:21 +01:00
dfw.mirror.rackspace.com:443
dfw.mirror.rackspace.com:80
2024-02-08 10:36:35 +01:00
dl-cdn.alpinelinux.org:443
2024-02-10 09:37:21 +01:00
download.cf.centos.org:443
download.cf.centos.org:80
epel.mirror.constant.com:443
ftp-nyc.osuosl.org:443
2024-02-08 07:56:34 +01:00
ftp-nyc.osuosl.org:80
2024-02-10 09:37:21 +01:00
ftp-osl.osuosl.org:443
2024-02-08 07:56:34 +01:00
ftp-osl.osuosl.org:80
2024-02-10 09:37:21 +01:00
ftp.plusline.net:443
ftp.plusline.net:80
2024-02-08 07:56:34 +01:00
ftpmirror.your.org:80
2024-02-08 10:36:35 +01:00
fulcio.sigstore.dev:443
github.com:443
2024-02-18 04:08:08 +01:00
ghcr.io:443
2024-02-10 09:37:21 +01:00
iad.mirror.rackspace.com:443
iad.mirror.rackspace.com:80
2024-02-08 10:36:35 +01:00
index.docker.io:443
2024-02-10 09:37:21 +01:00
lesnet.mm.fcix.net:443
mirror-mci.yuki.net.uk:443
mirror-mci.yuki.net.uk:80
mirror.arizona.edu:443
mirror.arizona.edu:80
2024-02-08 07:56:34 +01:00
mirror.dogado.de:443
mirror.dogado.de:80
2024-02-10 09:37:21 +01:00
mirror.facebook.net:443
mirror.facebook.net:80
mirror.fcix.net:443
mirror.hoobly.com:443
mirror.math.princeton.edu:443
2024-02-08 07:56:34 +01:00
mirror.netzwerge.de:443
mirror.pilotfiber.com:443
mirror.pilotfiber.com:80
2024-02-08 05:35:09 +01:00
mirror.rackspace.com:443
2024-02-08 07:56:34 +01:00
mirror.rackspace.com:80
2024-02-10 09:37:21 +01:00
mirror.scaleuptech.com:443
mirror.scaleuptech.com:80
mirror.servaxnet.com:443
2024-02-08 07:56:34 +01:00
mirror.servaxnet.com:80
mirror.siena.edu:80
2024-02-10 09:37:21 +01:00
mirror.stream.centos.org:443
mirror.stream.centos.org:80
mirror.team-cymru.com:443
2024-02-08 07:56:34 +01:00
mirror.team-cymru.com:80
mirror1.hs-esslingen.de:443
mirrors.centos.org:443
2024-02-10 09:37:21 +01:00
mirrors.fedoraproject.org:443
mirrors.fedoraproject.org:80
2024-02-08 07:56:34 +01:00
mirrors.iu13.net:80
2024-02-10 09:37:21 +01:00
mirrors.mit.edu:443
2024-02-08 07:56:34 +01:00
mirrors.ocf.berkeley.edu:443
2024-02-10 09:37:21 +01:00
mirrors.ocf.berkeley.edu:80
mirrors.sonic.net:443
mirrors.wcupa.edu:443
mirrors.wcupa.edu:80
2024-02-08 07:56:34 +01:00
mirrors.xtom.de:80
2024-02-10 09:37:21 +01:00
na.edge.kernel.org:443
nocix.mm.fcix.net:443
oauth2.sigstore.dev:443
2024-02-08 10:36:35 +01:00
objects.githubusercontent.com:443
ports.ubuntu.com:80
production.cloudflare.docker.com:443
quay.io:443
registry-1.docker.io:443
rekor.sigstore.dev:443
2024-02-10 09:37:21 +01:00
repo.ialab.dsu.edu:443
repos.eggycrew.com:443
repos.eggycrew.com:80
2024-02-08 10:36:35 +01:00
security.ubuntu.com:80
tuf-repo-cdn.sigstore.dev:443
2024-02-10 09:37:21 +01:00
uvermont.mm.fcix.net:443
2024-02-08 10:36:35 +01:00
yum.oracle.com:443
2024-02-10 09:37:21 +01:00
ziply.mm.fcix.net:443
2024-02-18 05:50:35 +01:00
pkg-containers.githubusercontent.com:443
2024-02-07 15:45:06 +01:00
2021-09-14 12:32:06 +02:00
- name: Checkout repository
2024-07-08 12:31:41 +02:00
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
2021-09-14 02:17:14 +02:00
with:
2024-02-10 15:04:06 +01:00
ref: ${{ env.TRUNK_ONLY_EVENT == 'true' && env.TRUNK_GIT_BRANCH || '' }}
2021-09-14 02:17:14 +02:00
fetch-depth: 1
2021-09-13 19:36:12 +02:00
2024-02-08 08:34:58 +01:00
- name: Install cosign
2024-02-17 15:24:24 +01:00
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382
2024-02-08 08:34:58 +01:00
with:
2024-02-08 08:43:43 +01:00
cosign-release: 'v2.2.3'
- name: Check cosign version
2024-02-17 15:24:24 +01:00
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
2024-02-08 08:43:43 +01:00
run: cosign version
2024-02-08 08:34:58 +01:00
2021-09-13 19:36:12 +02:00
- name: Set up QEMU
2024-07-08 12:31:41 +02:00
uses: docker/setup-qemu-action@5927c834f5b4fdf503fca6f4c7eccda82949e1ee # v3.1.0
2021-10-28 00:45:54 +02:00
with:
image: tonistiigi/binfmt:latest
platforms: all
2021-09-13 19:36:12 +02:00
- name: Set up Docker Buildx
2024-07-08 12:31:41 +02:00
uses: docker/setup-buildx-action@4fd812986e6c8c2a69e18311145f9371337f27d4 # v3.4.0
2021-10-28 00:45:54 +02:00
with:
driver-opts: image=moby/buildkit:master
2021-09-13 19:36:12 +02:00
2021-09-14 12:32:06 +02:00
- name: Prepare Platform list
2021-09-15 13:31:56 +02:00
id: platform
2024-02-08 18:56:49 +01:00
env:
2024-02-09 07:54:24 +01:00
MATRIX_OS: ${{ matrix.os }}
2024-02-08 18:56:49 +01:00
MATRIX_FILE: ${{ env.MATRIX_FILE }}
2021-09-13 19:36:12 +02:00
run: |
2024-02-09 07:54:24 +01:00
platform_list=$(jq -r ".[\"os-linux\"].$MATRIX_OS | join(\",\")" "$MATRIX_FILE")
2021-10-27 21:28:33 +02:00
platform_list="${platform_list%,}"
2021-09-13 19:36:12 +02:00
2024-02-09 19:40:40 +01:00
echo "::group::Platform List"
echo "$platform_list"
echo "::endgroup::"
2023-02-08 09:41:04 +01:00
echo "list=$platform_list" >> $GITHUB_OUTPUT
2021-09-13 19:36:12 +02:00
2024-02-07 19:27:02 +01:00
- name: Generate tags
id: meta
2024-02-11 17:44:17 +01:00
uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
2021-09-14 14:36:19 +02:00
with:
2024-02-18 07:11:56 +01:00
images: |
2024-02-18 07:19:51 +01:00
${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY_TEST, env.DOCKER_REPOSITORY_TEST, env.IMAGES_PREFIX, env.BASE_BUILD_NAME ) }},enable=${{ env.AUTO_PUSH_IMAGES != 'true' }}
2024-05-30 13:36:54 +02:00
${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, env.BASE_BUILD_NAME ) }},enable=${{ env.AUTO_PUSH_IMAGES == 'true' }}
2024-02-10 15:04:06 +01:00
context: ${{ env.TRUNK_ONLY_EVENT == 'true' && 'git' || '' }}
2021-09-14 14:36:19 +02:00
tags: |
2024-02-07 19:27:02 +01:00
type=semver,enable=${{ needs.init_build.outputs.current_branch != 'trunk' }},pattern={{version}},prefix=${{ matrix.os }}-
type=semver,enable=${{ needs.init_build.outputs.current_branch != 'trunk' }},pattern={{version}},suffix=-${{ matrix.os }}
2024-02-18 07:28:59 +01:00
type=ref,enable=${{ needs.init_build.outputs.current_branch != 'trunk' && !contains(fromJSON('["workflow_dispatch"]'), github.event_name) }},event=branch,prefix=${{ matrix.os }}-,suffix=-latest
type=ref,enable=${{ needs.init_build.outputs.current_branch != 'trunk' && !contains(fromJSON('["workflow_dispatch"]'), github.event_name) }},event=branch,suffix=-${{ matrix.os }}-latest
2024-02-07 19:27:02 +01:00
type=raw,enable=${{ (needs.init_build.outputs.current_branch != 'trunk') && (needs.init_build.outputs.is_default_branch == 'true') }},value=${{matrix.os}}-latest
type=ref,enable=${{ needs.init_build.outputs.current_branch == 'trunk' }},event=branch,prefix=${{ matrix.os }}-
2024-02-18 07:28:59 +01:00
type=ref,enable=${{ needs.init_build.outputs.current_branch == 'trunk' || contains(fromJSON('["workflow_dispatch"]'), github.event_name) }},event=branch,suffix=-${{ matrix.os }}
2021-09-14 15:22:13 +02:00
flavor: |
2024-02-17 18:00:53 +01:00
latest=${{ (matrix.os == 'alpine') && (!contains(fromJSON('["workflow_dispatch"]'), github.event_name)) && ( needs.init_build.outputs.is_default_branch == 'true' ) }}
2021-09-13 21:04:05 +02:00
2024-02-17 11:00:48 +01:00
- name: Prepare cache data
id: cache_data
env:
IMAGE_TAG: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
2024-02-17 15:24:24 +01:00
PUBLISH_IMAGES: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
2024-02-17 11:00:48 +01:00
run: |
cache_from=()
cache_to=()
2024-02-19 06:57:53 +01:00
cache_from+=("type=gha,scope=${IMAGE_TAG}")
#cache_from+=("type=registry,ref=${IMAGE_TAG}")
2024-02-17 11:00:48 +01:00
2024-02-17 14:50:10 +01:00
cache_to+=("type=gha,mode=max,scope=${IMAGE_TAG}")
2024-02-17 11:00:48 +01:00
echo "::group::Cache from data"
echo "${cache_from[*]}"
echo "::endgroup::"
echo "::group::Cache to data"
echo "${cache_to[*]}"
echo "::endgroup::"
2024-02-17 14:33:16 +01:00
cache_from=$(printf '%s\n' "${cache_from[@]}")
2024-02-17 14:29:11 +01:00
cache_to=$(printf '%s\n' "${cache_to[@]}")
2024-02-17 12:35:11 +01:00
2024-02-17 14:33:16 +01:00
echo 'cache_from<<EOF' >> "$GITHUB_OUTPUT"
echo "$cache_from" >> "$GITHUB_OUTPUT"
echo 'EOF' >> "$GITHUB_OUTPUT"
2024-02-17 14:35:47 +01:00
echo 'cache_to<<EOF' >> "$GITHUB_OUTPUT"
echo "$cache_to" >> "$GITHUB_OUTPUT"
echo 'EOF' >> "$GITHUB_OUTPUT"
2024-02-17 11:00:48 +01:00
2024-02-18 07:59:40 +01:00
- name: Login to DockerHub
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
2024-07-08 12:31:41 +02:00
uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
2024-02-18 07:59:40 +01:00
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: Login to ${{ env.DOCKER_REGISTRY_TEST }}
if: ${{ env.AUTO_PUSH_IMAGES != 'true' }}
2024-07-08 12:31:41 +02:00
uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
2024-02-18 07:59:40 +01:00
with:
registry: ${{ env.DOCKER_REGISTRY_TEST }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
2024-02-09 07:54:24 +01:00
- name: Build and publish image
2024-02-07 19:15:07 +01:00
id: docker_build
2024-07-08 12:31:41 +02:00
uses: docker/build-push-action@1a162644f9a7e87d8f4b053101d1d9a712edc18c # v6.3.0
2024-02-07 19:15:07 +01:00
with:
2024-02-18 07:14:50 +01:00
context: ${{ format('{0}/{1}/{2}', env.DOCKERFILES_DIRECTORY, env.BASE_BUILD_NAME, matrix.os) }}
file: ${{ format('{0}/{1}/{2}/Dockerfile', env.DOCKERFILES_DIRECTORY, env.BASE_BUILD_NAME, matrix.os) }}
2024-02-07 19:15:07 +01:00
platforms: ${{ steps.platform.outputs.list }}
2024-02-18 04:12:27 +01:00
push: true
2024-02-28 10:05:16 +01:00
provenance: mode=max
sbom: true
2024-02-07 19:32:12 +01:00
tags: ${{ steps.meta.outputs.tags }}
2024-02-07 19:15:07 +01:00
labels: |
2024-02-07 19:27:02 +01:00
org.opencontainers.image.revision=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
org.opencontainers.image.created=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
2024-02-18 12:56:30 +01:00
cache-from: ${{ steps.cache_data.outputs.cache_from }}
2024-02-19 06:57:53 +01:00
cache-to: ${{ steps.cache_data.outputs.cache_to }}
2024-02-17 18:00:53 +01:00
2024-02-08 08:34:58 +01:00
- name: Sign the images with GitHub OIDC Token
2024-02-17 15:24:24 +01:00
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
2024-02-08 08:34:58 +01:00
env:
DIGEST: ${{ steps.docker_build.outputs.digest }}
TAGS: ${{ steps.meta.outputs.tags }}
run: |
2024-02-19 10:28:42 +01:00
images=""
for tag in ${TAGS}; do
images+="${tag}@${DIGEST} "
done
2024-02-09 19:40:40 +01:00
echo "::group::Images to sign"
echo "$images"
echo "::endgroup::"
echo "::group::Signing"
echo "cosign sign --yes $images"
cosign sign --yes ${images}
echo "::endgroup::"
2024-02-08 08:34:58 +01:00
2024-05-30 13:36:54 +02:00
- name: Attest images
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
id: attest
uses: actions/attest-build-provenance@v1
with:
subject-name: ${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, env.BASE_BUILD_NAME ) }}
subject-digest: ${{ steps.docker_build.outputs.digest }}
push-to-registry: true
2024-02-19 06:57:53 +01:00
- name: Image metadata
2024-02-08 17:59:21 +01:00
env:
2024-02-19 06:57:53 +01:00
CACHE_FILE_NAME: ${{ env.BASE_CACHE_FILE_NAME }}
2024-02-18 07:28:59 +01:00
METADATA: ${{ steps.docker_build.outputs.metadata }}
2024-02-08 14:03:56 +01:00
run: |
2024-02-18 07:49:20 +01:00
echo "::group::Image metadata"
echo "${METADATA}"
2024-02-09 18:40:10 +01:00
echo "::endgroup::"
echo "::group::Cache file name"
2024-02-18 07:49:20 +01:00
echo "${CACHE_FILE_NAME}"
2024-02-09 18:40:10 +01:00
echo "::endgroup::"
2024-02-18 07:49:20 +01:00
echo "${METADATA}" > "$CACHE_FILE_NAME"
2024-02-08 14:03:56 +01:00
2024-02-19 06:57:53 +01:00
- name: Cache image metadata
2024-02-11 17:44:17 +01:00
uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
2024-02-08 13:37:15 +01:00
with:
2024-02-19 06:57:53 +01:00
path: ${{ env.BASE_CACHE_FILE_NAME }}
2024-02-08 17:59:21 +01:00
key: ${{ env.BASE_BUILD_NAME }}-${{ matrix.os }}-${{ github.run_id }}
2024-02-08 13:37:15 +01:00
2024-02-08 05:16:27 +01:00
build_base_database:
timeout-minutes: 180
needs: [ "build_base", "init_build"]
name: Build ${{ matrix.build }} base on ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
build: ${{ fromJson(needs.init_build.outputs.database) }}
os: ${{ fromJson(needs.init_build.outputs.os) }}
runs-on: ubuntu-latest
permissions:
contents: read
2024-02-08 10:36:35 +01:00
id-token: write
2024-02-18 05:24:47 +01:00
packages: write
2024-05-30 13:36:54 +02:00
attestations: write
2024-02-08 05:16:27 +01:00
steps:
- name: Block egress traffic
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
2024-02-08 05:16:27 +01:00
with:
2024-02-08 10:36:35 +01:00
disable-sudo: true
egress-policy: block
allowed-endpoints: >
api.github.com:443
auth.docker.io:443
git.zabbix.com:443
github.com:443
go.googlesource.com:443
go.mongodb.org:443
golang.org:443
google.golang.org:443
2024-04-24 08:38:35 +02:00
golang.zabbix.com:443
2024-02-08 10:36:35 +01:00
gopkg.in:443
2024-02-18 04:08:08 +01:00
ghcr.io:443
2024-02-08 10:36:35 +01:00
index.docker.io:443
noto-website.storage.googleapis.com:443
production.cloudflare.docker.com:443
proxy.golang.org:443
registry-1.docker.io:443
storage.googleapis.com:443
2024-02-08 12:12:39 +01:00
fulcio.sigstore.dev:443
2024-02-08 19:32:12 +01:00
oauth2.sigstore.dev:443
2024-02-08 12:12:39 +01:00
objects.githubusercontent.com:443
tuf-repo-cdn.sigstore.dev:443
2024-02-08 13:37:15 +01:00
rekor.sigstore.dev:443
2024-02-18 05:50:35 +01:00
pkg-containers.githubusercontent.com:443
2024-02-08 05:16:27 +01:00
- name: Checkout repository
2024-07-08 12:31:41 +02:00
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
2024-02-08 05:35:09 +01:00
with:
2024-02-10 15:04:06 +01:00
ref: ${{ env.TRUNK_ONLY_EVENT == 'true' && env.TRUNK_GIT_BRANCH || '' }}
2024-02-08 05:35:09 +01:00
fetch-depth: 1
2024-02-08 05:16:27 +01:00
2024-02-08 10:36:35 +01:00
- name: Install cosign
2024-02-17 15:35:23 +01:00
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382
2024-02-08 10:36:35 +01:00
with:
cosign-release: 'v2.2.3'
- name: Check cosign version
2024-02-17 15:35:23 +01:00
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
2024-02-08 10:36:35 +01:00
run: cosign version
2024-02-08 05:16:27 +01:00
- name: Set up QEMU
2024-07-08 12:31:41 +02:00
uses: docker/setup-qemu-action@5927c834f5b4fdf503fca6f4c7eccda82949e1ee # v3.1.0
2024-02-08 05:16:27 +01:00
with:
image: tonistiigi/binfmt:latest
platforms: all
- name: Set up Docker Buildx
2024-07-08 12:31:41 +02:00
uses: docker/setup-buildx-action@4fd812986e6c8c2a69e18311145f9371337f27d4 # v3.4.0
2024-02-08 05:16:27 +01:00
with:
driver-opts: image=moby/buildkit:master
- name: Prepare Platform list
id: platform
2024-02-08 18:56:49 +01:00
env:
2024-02-09 07:54:24 +01:00
MATRIX_OS: ${{ matrix.os }}
2024-02-08 18:56:49 +01:00
MATRIX_FILE: ${{ env.MATRIX_FILE }}
2024-02-08 05:16:27 +01:00
run: |
2024-02-09 07:54:24 +01:00
platform_list=$(jq -r ".[\"os-linux\"].$MATRIX_OS | join(\",\")" "$MATRIX_FILE")
2024-02-08 05:16:27 +01:00
platform_list="${platform_list%,}"
2024-02-10 09:37:21 +01:00
echo "::group::Platform List"
echo "$platform_list"
echo "::endgroup::"
2024-02-08 05:16:27 +01:00
echo "list=$platform_list" >> $GITHUB_OUTPUT
- name: Generate tags
id: meta
2024-02-11 17:44:17 +01:00
uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
2024-02-08 05:16:27 +01:00
with:
2024-02-18 09:18:22 +01:00
images: |
${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY_TEST, env.DOCKER_REPOSITORY_TEST, env.IMAGES_PREFIX, matrix.build ) }},enable=${{ env.AUTO_PUSH_IMAGES != 'true' }}
2024-05-30 13:36:54 +02:00
${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, matrix.build ) }},enable=${{ env.AUTO_PUSH_IMAGES == 'true' }}
2024-02-10 15:04:06 +01:00
context: ${{ env.TRUNK_ONLY_EVENT == 'true' && 'git' || '' }}
2024-02-08 05:16:27 +01:00
tags: |
type=semver,enable=${{ needs.init_build.outputs.current_branch != 'trunk' }},pattern={{version}},prefix=${{ matrix.os }}-
type=semver,enable=${{ needs.init_build.outputs.current_branch != 'trunk' }},pattern={{version}},suffix=-${{ matrix.os }}
2024-02-18 07:49:20 +01:00
type=ref,enable=${{ needs.init_build.outputs.current_branch != 'trunk' && (!contains(fromJSON('["workflow_dispatch"]'), github.event_name)) }},event=branch,prefix=${{ matrix.os }}-,suffix=-latest
type=ref,enable=${{ needs.init_build.outputs.current_branch != 'trunk' && (!contains(fromJSON('["workflow_dispatch"]'), github.event_name)) }},event=branch,suffix=-${{ matrix.os }}-latest
2024-02-08 05:16:27 +01:00
type=raw,enable=${{ (needs.init_build.outputs.current_branch != 'trunk') && (needs.init_build.outputs.is_default_branch == 'true') }},value=${{matrix.os}}-latest
type=ref,enable=${{ needs.init_build.outputs.current_branch == 'trunk' }},event=branch,prefix=${{ matrix.os }}-
2024-02-18 07:49:20 +01:00
type=ref,enable=${{ needs.init_build.outputs.current_branch == 'trunk' || contains(fromJSON('["workflow_dispatch"]'), github.event_name) }},event=branch,suffix=-${{ matrix.os }}
2024-02-08 05:16:27 +01:00
flavor: |
2024-02-17 18:00:53 +01:00
latest=${{ (matrix.os == 'alpine') && (!contains(fromJSON('["workflow_dispatch"]'), github.event_name)) && ( needs.init_build.outputs.is_default_branch == 'true' ) }}
2024-02-08 05:16:27 +01:00
2024-02-19 06:57:53 +01:00
- name: Download metadata of ${{ env.BASE_BUILD_NAME }}:${{ matrix.os }}
2024-02-11 17:44:17 +01:00
uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
2024-02-08 14:03:56 +01:00
with:
2024-02-19 06:57:53 +01:00
path: ${{ env.BASE_CACHE_FILE_NAME }}
2024-02-10 09:37:21 +01:00
key: ${{ env.BASE_BUILD_NAME }}-${{ matrix.os }}-${{ github.run_id }}
2024-02-08 14:03:56 +01:00
2024-02-18 07:49:20 +01:00
- name: Process ${{ env.BASE_BUILD_NAME }}:${{ matrix.os }} image metadata
2024-02-08 05:16:27 +01:00
id: base_build
2024-02-19 06:57:53 +01:00
env:
CACHE_FILE_NAME: ${{ env.BASE_CACHE_FILE_NAME }}
2024-02-08 05:16:27 +01:00
run: |
2024-02-18 07:49:20 +01:00
echo "::group::Base image metadata"
2024-02-19 06:57:53 +01:00
cat "${CACHE_FILE_NAME}"
2024-02-10 09:37:21 +01:00
echo "::endgroup::"
2024-02-08 05:16:27 +01:00
2024-02-19 06:57:53 +01:00
IMAGE_DIGEST=$(jq -r '."containerimage.digest"' "${CACHE_FILE_NAME}")
IMAGE_NAME=$(jq -r '."image.name"' "${CACHE_FILE_NAME}" | cut -d: -f1)
2024-02-18 07:49:20 +01:00
2024-02-18 07:59:40 +01:00
echo "base_build_image=${IMAGE_NAME}@${IMAGE_DIGEST}" >> $GITHUB_OUTPUT
2024-02-10 09:37:21 +01:00
- name: Verify ${{ env.BASE_BUILD_NAME }}:${{ matrix.os }} cosign
2024-02-17 15:24:24 +01:00
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
2024-02-08 17:59:21 +01:00
env:
BASE_IMAGE: ${{ steps.base_build.outputs.base_build_image }}
2024-02-09 07:54:24 +01:00
OIDC_ISSUER: ${{ env.OIDC_ISSUER }}
2024-02-19 06:57:53 +01:00
IDENTITY_REGEX: ${{ env.IDENTITY_REGEX }}
2024-02-08 17:59:21 +01:00
run: |
2024-02-10 09:37:21 +01:00
echo "::group::Image sign data"
echo "OIDC issuer=$OIDC_ISSUER"
2024-02-19 06:57:53 +01:00
echo "Identity=$IDENTITY_REGEX"
2024-02-10 09:37:21 +01:00
echo "Image to verify=$BASE_IMAGE"
echo "::endgroup::"
echo "::group::Verify signature"
cosign verify \
--certificate-oidc-issuer-regexp "$OIDC_ISSUER" \
2024-02-19 06:57:53 +01:00
--certificate-identity-regexp "$IDENTITY_REGEX" \
2024-05-30 13:36:54 +02:00
"$BASE_IMAGE" | jq
2024-02-10 09:37:21 +01:00
echo "::endgroup::"
2024-02-08 17:59:21 +01:00
2024-02-17 14:50:10 +01:00
- name: Prepare cache data
id: cache_data
env:
BASE_IMAGE_TAG: ${{ steps.base_build.outputs.base_build_image }}
IMAGE_TAG: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
2024-02-17 15:24:24 +01:00
PUBLISH_IMAGES: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
2024-02-17 14:50:10 +01:00
run: |
cache_from=()
cache_to=()
2024-02-19 06:57:53 +01:00
cache_from+=("type=gha,scope=${BASE_IMAGE_TAG}")
cache_from+=("type=registry,ref=${BASE_IMAGE_TAG}")
cache_from+=("type=gha,scope=${IMAGE_TAG}")
2024-02-17 18:00:53 +01:00
cache_from+=("type=registry,ref=${IMAGE_TAG}")
2024-02-17 14:50:10 +01:00
cache_to+=("type=gha,mode=max,scope=${IMAGE_TAG}")
echo "::group::Cache from data"
echo "${cache_from[*]}"
echo "::endgroup::"
echo "::group::Cache to data"
echo "${cache_to[*]}"
echo "::endgroup::"
cache_from=$(printf '%s\n' "${cache_from[@]}")
cache_to=$(printf '%s\n' "${cache_to[@]}")
echo 'cache_from<<EOF' >> "$GITHUB_OUTPUT"
echo "$cache_from" >> "$GITHUB_OUTPUT"
echo 'EOF' >> "$GITHUB_OUTPUT"
echo 'cache_to<<EOF' >> "$GITHUB_OUTPUT"
echo "$cache_to" >> "$GITHUB_OUTPUT"
echo 'EOF' >> "$GITHUB_OUTPUT"
2024-02-18 07:59:40 +01:00
- name: Login to DockerHub
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
2024-07-08 12:31:41 +02:00
uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
2024-02-18 07:59:40 +01:00
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
2024-02-19 11:16:49 +01:00
- name: Login to ${{ env.DOCKER_REGISTRY_TEST }}
2024-02-18 07:59:40 +01:00
if: ${{ env.AUTO_PUSH_IMAGES != 'true' }}
2024-07-08 12:31:41 +02:00
uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
2024-02-18 07:59:40 +01:00
with:
2024-02-19 11:16:49 +01:00
registry: ${{ env.DOCKER_REGISTRY_TEST }}
2024-02-18 07:59:40 +01:00
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
2024-02-08 05:16:27 +01:00
- name: Build ${{ matrix.build }}/${{ matrix.os }} and push
id: docker_build
2024-07-08 12:31:41 +02:00
uses: docker/build-push-action@1a162644f9a7e87d8f4b053101d1d9a712edc18c # v6.3.0
2024-02-08 05:16:27 +01:00
with:
2024-02-18 08:00:20 +01:00
context: ${{ format('{0}/{1}/{2}/', env.DOCKERFILES_DIRECTORY, matrix.build, matrix.os) }}
file: ${{ format('{0}/{1}/{2}/Dockerfile', env.DOCKERFILES_DIRECTORY, matrix.build, matrix.os) }}
2024-02-08 05:16:27 +01:00
platforms: ${{ steps.platform.outputs.list }}
2024-02-18 04:59:27 +01:00
push: true
2024-02-28 10:05:16 +01:00
provenance: mode=max
sbom: true
2024-02-08 05:16:27 +01:00
tags: ${{ steps.meta.outputs.tags }}
build-args: BUILD_BASE_IMAGE=${{ steps.base_build.outputs.base_build_image }}
labels: |
org.opencontainers.image.revision=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
org.opencontainers.image.created=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
2024-02-17 18:00:53 +01:00
2024-02-08 10:36:35 +01:00
- name: Sign the images with GitHub OIDC Token
2024-02-17 15:24:24 +01:00
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
2024-02-08 10:36:35 +01:00
env:
DIGEST: ${{ steps.docker_build.outputs.digest }}
TAGS: ${{ steps.meta.outputs.tags }}
run: |
2024-02-19 10:28:42 +01:00
images=""
for tag in ${TAGS}; do
images+="${tag}@${DIGEST} "
done
2024-02-10 09:37:21 +01:00
echo "::group::Images to sign"
echo "$images"
echo "::endgroup::"
echo "::group::Signing"
echo "cosign sign --yes $images"
cosign sign --yes ${images}
echo "::endgroup::"
2024-02-08 10:36:35 +01:00
2024-05-30 13:36:54 +02:00
- name: Attest images
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
id: attest
uses: actions/attest-build-provenance@v1
with:
subject-name: ${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, matrix.build ) }}
subject-digest: ${{ steps.docker_build.outputs.digest }}
push-to-registry: true
2024-02-19 06:57:53 +01:00
- name: Image metadata
2024-02-08 18:56:49 +01:00
env:
2024-02-19 06:57:53 +01:00
CACHE_FILE_NAME: ${{ env.BUILD_CACHE_FILE_NAME }}
2024-02-18 11:09:50 +01:00
METADATA: ${{ steps.docker_build.outputs.metadata }}
2024-02-08 05:16:27 +01:00
run: |
2024-02-18 08:20:22 +01:00
echo "::group::Image metadata"
echo "${METADATA}"
2024-02-10 09:37:21 +01:00
echo "::endgroup::"
echo "::group::Cache file name"
2024-02-18 08:20:22 +01:00
echo "${CACHE_FILE_NAME}"
2024-02-10 09:37:21 +01:00
echo "::endgroup::"
2024-02-18 08:20:22 +01:00
echo "${METADATA}" > "$CACHE_FILE_NAME"
2024-02-08 05:16:27 +01:00
2024-02-19 06:57:53 +01:00
- name: Cache image metadata
2024-02-11 17:44:17 +01:00
uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
2024-02-08 05:16:27 +01:00
with:
2024-02-19 06:57:53 +01:00
path: ${{ env.BUILD_CACHE_FILE_NAME }}
2024-02-08 17:59:21 +01:00
key: ${{ matrix.build }}-${{ matrix.os }}-${{ github.run_id }}
2024-02-08 05:16:27 +01:00
build_images:
timeout-minutes: 90
needs: [ "build_base_database", "init_build"]
name: Build ${{ matrix.build }} on ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
build: ${{ fromJson(needs.init_build.outputs.components) }}
os: ${{ fromJson(needs.init_build.outputs.os) }}
runs-on: ubuntu-latest
permissions:
contents: read
2024-02-08 19:43:56 +01:00
id-token: write
2024-02-19 14:15:38 +01:00
packages: write
2024-05-30 13:36:54 +02:00
attestations: write
2024-02-08 05:16:27 +01:00
steps:
2024-02-08 19:12:25 +01:00
- name: Block egress traffic
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
2024-02-08 17:16:52 +01:00
with:
disable-sudo: true
egress-policy: block
allowed-endpoints: >
api.github.com:443
auth.docker.io:443
dl-cdn.alpinelinux.org:443
github.com:443
index.docker.io:443
production.cloudflare.docker.com:443
registry-1.docker.io:443
fulcio.sigstore.dev:443
objects.githubusercontent.com:443
tuf-repo-cdn.sigstore.dev:443
rekor.sigstore.dev:443
api.github.com:443
atl.mirrors.knownhost.com:443
atl.mirrors.knownhost.com:80
auth.docker.io:443
cdn03.quay.io:443
centos-stream-distro.1gservers.com:443
centos-stream-distro.1gservers.com:80
2024-04-26 12:08:17 +02:00
download.cf.centos.org:443
download.cf.centos.org:80
2024-02-08 17:16:52 +01:00
d2lzkl7pfhq30w.cloudfront.net:443
epel.mirror.constant.com:80
forksystems.mm.fcix.net:80
ftp-nyc.osuosl.org:443
ftp-nyc.osuosl.org:80
ftp-osl.osuosl.org:443
ftp-osl.osuosl.org:80
ftp.plusline.net:80
ftpmirror.your.org:80
github.com:443
iad.mirror.rackspace.com:443
index.docker.io:443
ix-denver.mm.fcix.net:443
mirror-mci.yuki.net.uk:443
mirror.23m.com:80
mirror.arizona.edu:80
mirror.dal.nexril.net:80
mirror.de.leaseweb.net:80
mirror.dogado.de:80
mirror.facebook.net:80
mirror.hoobly.com:80
mirror.math.princeton.edu:80
mirror.netcologne.de:443
mirror.netzwerge.de:443
mirror.pilotfiber.com:443
mirror.pilotfiber.com:80
mirror.rackspace.com:443
mirror.rackspace.com:80
mirror.scaleuptech.com:443
mirror.servaxnet.com:443
mirror.servaxnet.com:80
mirror.sfo12.us.leaseweb.net:80
mirror.siena.edu:80
mirror.steadfastnet.com:80
mirror.team-cymru.com:443
mirror.team-cymru.com:80
mirror.umd.edu:443
mirror1.hs-esslingen.de:443
mirrors.centos.org:443
mirrors.fedoraproject.org:443
mirrors.iu13.net:443
mirrors.iu13.net:80
mirrors.ocf.berkeley.edu:443
mirrors.sonic.net:80
mirrors.syringanetworks.net:80
mirrors.vcea.wsu.edu:80
mirrors.wcupa.edu:80
mirrors.xtom.de:80
na.edge.kernel.org:443
nnenix.mm.fcix.net:80
ohioix.mm.fcix.net:80
production.cloudflare.docker.com:443
pubmirror1.math.uh.edu:443
pubmirror3.math.uh.edu:80
quay.io:443
2024-02-18 12:56:30 +01:00
ghcr.io:443
2024-02-08 17:16:52 +01:00
registry-1.docker.io:443
repo.ialab.dsu.edu:80
repos.eggycrew.com:80
uvermont.mm.fcix.net:80
ziply.mm.fcix.net:443
fulcio.sigstore.dev:443
objects.githubusercontent.com:443
tuf-repo-cdn.sigstore.dev:443
rekor.sigstore.dev:443
2024-02-08 19:32:12 +01:00
oauth2.sigstore.dev:443
2024-02-08 17:16:52 +01:00
api.github.com:443
auth.docker.io:443
github.com:443
index.docker.io:443
production.cloudflare.docker.com:443
registry-1.docker.io:443
yum.oracle.com:443
fulcio.sigstore.dev:443
objects.githubusercontent.com:443
tuf-repo-cdn.sigstore.dev:443
rekor.sigstore.dev:443
api.github.com:443
archive.ubuntu.com:80
auth.docker.io:443
deb.debian.org:80
github.com:443
index.docker.io:443
keyserver.ubuntu.com:11371
nginx.org:443
nginx.org:80
ports.ubuntu.com:80
production.cloudflare.docker.com:443
registry-1.docker.io:443
security.ubuntu.com:80
fulcio.sigstore.dev:443
objects.githubusercontent.com:443
tuf-repo-cdn.sigstore.dev:443
rekor.sigstore.dev:443
2024-02-18 05:50:35 +01:00
pkg-containers.githubusercontent.com:443
2024-02-08 05:16:27 +01:00
- name: Checkout repository
2024-07-08 12:31:41 +02:00
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
2024-02-08 05:35:09 +01:00
with:
2024-02-10 15:04:06 +01:00
ref: ${{ env.TRUNK_ONLY_EVENT == 'true' && env.TRUNK_GIT_BRANCH || '' }}
2024-02-08 05:35:09 +01:00
fetch-depth: 1
2024-02-08 05:16:27 +01:00
2024-02-08 16:44:14 +01:00
- name: Install cosign
2024-02-19 06:57:53 +01:00
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382
2024-02-08 16:44:14 +01:00
with:
cosign-release: 'v2.2.3'
- name: Check cosign version
2024-02-19 06:57:53 +01:00
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
2024-02-08 16:44:14 +01:00
run: cosign version
2024-02-08 05:16:27 +01:00
- name: Set up QEMU
2024-07-08 12:31:41 +02:00
uses: docker/setup-qemu-action@5927c834f5b4fdf503fca6f4c7eccda82949e1ee # v3.1.0
2024-02-08 05:16:27 +01:00
with:
image: tonistiigi/binfmt:latest
platforms: all
- name: Set up Docker Buildx
2024-07-08 12:31:41 +02:00
uses: docker/setup-buildx-action@4fd812986e6c8c2a69e18311145f9371337f27d4 # v3.4.0
2024-02-08 05:16:27 +01:00
with:
driver-opts: image=moby/buildkit:master
- name: Prepare Platform list
id: platform
2024-02-08 18:56:49 +01:00
env:
MATRIX_OS: ${{ matrix.os }}
MATRIX_BUILD: ${{ matrix.build }}
MATRIX_FILE: ${{ env.MATRIX_FILE }}
2024-02-08 05:16:27 +01:00
run: |
# Chromium on Alpine is available only on linux/amd64, linux/arm64 platforms
2024-02-09 08:18:02 +01:00
if ([ "$MATRIX_OS" == "alpine" ] || [ "$MATRIX_OS" == "centos" ]) && [ "$MATRIX_BUILD" == "web-service" ]; then
2024-02-08 05:16:27 +01:00
platform_list="linux/amd64,linux/arm64"
2024-04-24 14:47:29 +02:00
# Chromium on Ubuntu is not available on s390x and armhf platform
2024-02-09 07:54:24 +01:00
elif [ "$MATRIX_OS" == "ubuntu" ] && [ "$MATRIX_BUILD" == "web-service" ]; then
2024-04-24 14:47:29 +02:00
platform_list="linux/amd64,linux/arm64"
2024-02-08 05:16:27 +01:00
else
2024-02-09 07:54:24 +01:00
platform_list=$(jq -r ".[\"os-linux\"].\"$MATRIX_OS\" | join(\",\")" "$MATRIX_FILE")
2024-02-08 05:16:27 +01:00
fi
# Build only Agent and Agent2 on 386
2024-02-09 07:54:24 +01:00
if [ "$MATRIX_BUILD" != "agent"* ]; then
2024-02-08 05:16:27 +01:00
platform_list="${platform_list#linux/386,}"
fi
platform_list="${platform_list%,}"
2024-02-10 09:37:21 +01:00
echo "::group::Platform List"
echo "$platform_list"
echo "::endgroup::"
2024-02-08 05:16:27 +01:00
echo "list=$platform_list" >> $GITHUB_OUTPUT
- name: Detect Build Base Image
id: build_base_image
2024-02-08 18:56:49 +01:00
env:
2024-02-09 07:54:24 +01:00
MATRIX_BUILD: ${{ matrix.build }}
2024-02-08 18:56:49 +01:00
MATRIX_FILE: ${{ env.MATRIX_FILE }}
2024-02-08 05:16:27 +01:00
run: |
2024-02-14 09:25:33 +01:00
BUILD_BASE=$(jq -r ".components.\"$MATRIX_BUILD\".base" "$MATRIX_FILE")
2024-02-10 09:37:21 +01:00
echo "::group::Base Build Image"
echo "$BUILD_BASE"
echo "::endgroup::"
2024-02-08 05:16:27 +01:00
2024-02-10 09:37:21 +01:00
echo "build_base=${BUILD_BASE}" >> $GITHUB_OUTPUT
2024-02-08 05:16:27 +01:00
- name: Generate tags
id: meta
2024-02-11 17:44:17 +01:00
uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
2024-02-08 05:16:27 +01:00
with:
2024-02-18 09:18:22 +01:00
images: |
${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY_TEST, env.DOCKER_REPOSITORY_TEST, env.IMAGES_PREFIX, matrix.build ) }},enable=${{ env.AUTO_PUSH_IMAGES != 'true' }}
2024-05-30 13:36:54 +02:00
${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, matrix.build ) }},enable=${{ env.AUTO_PUSH_IMAGES == 'true' }}
2024-02-10 15:04:06 +01:00
context: ${{ env.TRUNK_ONLY_EVENT == 'true' && 'git' || '' }}
2024-02-08 05:16:27 +01:00
tags: |
type=semver,enable=${{ needs.init_build.outputs.current_branch != 'trunk' }},pattern={{version}},prefix=${{ matrix.os }}-
type=semver,enable=${{ needs.init_build.outputs.current_branch != 'trunk' }},pattern={{version}},suffix=-${{ matrix.os }}
2024-02-19 06:57:53 +01:00
type=ref,enable=${{ needs.init_build.outputs.current_branch != 'trunk' && !contains(fromJSON('["workflow_dispatch"]'), github.event_name) }},event=branch,prefix=${{ matrix.os }}-,suffix=-latest
type=ref,enable=${{ needs.init_build.outputs.current_branch != 'trunk' && !contains(fromJSON('["workflow_dispatch"]'), github.event_name) }},event=branch,suffix=-${{ matrix.os }}-latest
2024-02-08 05:16:27 +01:00
type=raw,enable=${{ (needs.init_build.outputs.current_branch != 'trunk') && (needs.init_build.outputs.is_default_branch == 'true') }},value=${{matrix.os}}-latest
type=ref,enable=${{ needs.init_build.outputs.current_branch == 'trunk' }},event=branch,prefix=${{ matrix.os }}-
2024-02-18 08:20:22 +01:00
type=ref,enable=${{ needs.init_build.outputs.current_branch == 'trunk' || contains(fromJSON('["workflow_dispatch"]'), github.event_name) }},event=branch,suffix=-${{ matrix.os }}
2024-02-08 05:16:27 +01:00
flavor: |
2024-02-17 18:00:53 +01:00
latest=${{ (matrix.os == 'alpine') && (!contains(fromJSON('["workflow_dispatch"]'), github.event_name)) && ( needs.init_build.outputs.is_default_branch == 'true' ) }}
2024-02-08 05:16:27 +01:00
2024-02-19 06:57:53 +01:00
- name: Download metadata of ${{ steps.build_base_image.outputs.build_base }}:${{ matrix.os }}
2024-02-11 17:44:17 +01:00
uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
2024-02-08 05:16:27 +01:00
if: ${{ matrix.build != 'snmptraps' }}
with:
2024-02-19 06:57:53 +01:00
path: ${{ env.BUILD_CACHE_FILE_NAME }}
2024-02-08 17:59:21 +01:00
key: ${{ steps.build_base_image.outputs.build_base }}-${{ matrix.os }}-${{ github.run_id }}
2024-02-08 05:16:27 +01:00
2024-02-19 06:57:53 +01:00
- name: Process ${{ steps.build_base_image.outputs.build_base }}:${{ matrix.os }} image metadata
2024-02-08 05:16:27 +01:00
id: base_build
if: ${{ matrix.build != 'snmptraps' }}
2024-02-18 14:42:23 +01:00
env:
2024-02-19 06:57:53 +01:00
CACHE_FILE_NAME: ${{ env.BUILD_CACHE_FILE_NAME }}
2024-02-08 05:16:27 +01:00
run: |
2024-02-18 08:20:22 +01:00
echo "::group::Base build image metadata"
2024-02-18 14:42:23 +01:00
cat "${CACHE_FILE_NAME}"
2024-02-10 09:37:21 +01:00
echo "::endgroup::"
2024-02-08 05:16:27 +01:00
2024-02-18 14:42:23 +01:00
IMAGE_DIGEST=$(jq -r '."containerimage.digest"' "${CACHE_FILE_NAME}")
IMAGE_NAME=$(jq -r '."image.name"' "${CACHE_FILE_NAME}" | cut -d: -f1)
2024-02-18 08:20:22 +01:00
echo "base_build_image=${IMAGE_NAME}@${IMAGE_DIGEST}" >> $GITHUB_OUTPUT
2024-02-08 05:16:27 +01:00
2024-02-08 17:59:21 +01:00
- name: Verify ${{ steps.build_base_image.outputs.build_base }}:${{ matrix.os }} cosign
2024-02-17 15:24:24 +01:00
if: ${{ matrix.build != 'snmptraps' && env.AUTO_PUSH_IMAGES == 'true' }}
2024-02-08 17:59:21 +01:00
env:
BASE_IMAGE: ${{ steps.base_build.outputs.base_build_image }}
2024-02-09 07:54:24 +01:00
OIDC_ISSUER: ${{ env.OIDC_ISSUER }}
2024-02-19 06:57:53 +01:00
IDENTITY_REGEX: ${{ env.IDENTITY_REGEX }}
2024-02-08 17:59:21 +01:00
run: |
2024-02-10 09:37:21 +01:00
echo "::group::Image sign data"
2024-02-19 06:57:53 +01:00
echo "OIDC issuer=${OIDC_ISSUER}"
echo "Identity=${IDENTITY_REGEX}"
echo "Image to verify=${BASE_IMAGE}"
2024-02-10 09:37:21 +01:00
echo "::endgroup::"
echo "::group::Verify signature"
cosign verify \
2024-02-19 06:57:53 +01:00
--certificate-oidc-issuer-regexp "${OIDC_ISSUER}" \
--certificate-identity-regexp "${IDENTITY_REGEX}" \
2024-05-30 13:36:54 +02:00
"${BASE_IMAGE}" | jq
2024-02-10 09:37:21 +01:00
echo "::endgroup::"
2024-02-08 17:59:21 +01:00
2024-02-11 13:04:33 +01:00
- name: Prepare cache data
2024-02-19 06:57:53 +01:00
if: ${{ matrix.build != 'snmptraps' }}
2024-02-11 13:04:33 +01:00
id: cache_data
env:
BASE_IMAGE_TAG: ${{ steps.base_build.outputs.base_build_image }}
run: |
2024-02-17 14:50:10 +01:00
cache_from=()
cache_to=()
cache_from+=("type=registry,ref=${BASE_IMAGE_TAG}")
2024-02-11 13:04:33 +01:00
2024-02-17 14:50:10 +01:00
echo "::group::Cache from data"
echo "${cache_from[*]}"
2024-02-11 13:04:33 +01:00
echo "::endgroup::"
2024-02-17 14:50:10 +01:00
cache_from=$(printf '%s\n' "${cache_from[@]}")
echo 'cache_from<<EOF' >> "$GITHUB_OUTPUT"
echo "$cache_from" >> "$GITHUB_OUTPUT"
echo 'EOF' >> "$GITHUB_OUTPUT"
2024-02-11 13:04:33 +01:00
2024-02-19 06:57:53 +01:00
- name: Login to DockerHub
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
2024-07-08 12:31:41 +02:00
uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
2024-02-19 06:57:53 +01:00
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
2024-02-10 09:37:21 +01:00
- name: Build and push image
2024-02-08 05:16:27 +01:00
id: docker_build
2024-07-08 12:31:41 +02:00
uses: docker/build-push-action@1a162644f9a7e87d8f4b053101d1d9a712edc18c # v6.3.0
2024-02-08 05:16:27 +01:00
with:
2024-02-19 06:57:53 +01:00
context: ${{ format('{0}/{1}/{2}', env.DOCKERFILES_DIRECTORY, matrix.build, matrix.os) }}
file: ${{ format('{0}/{1}/{2}/Dockerfile', env.DOCKERFILES_DIRECTORY, matrix.build, matrix.os) }}
2024-02-08 05:16:27 +01:00
platforms: ${{ steps.platform.outputs.list }}
2024-02-17 15:24:24 +01:00
push: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
2024-02-28 10:05:16 +01:00
provenance: mode=max
sbom: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
2024-02-08 05:16:27 +01:00
tags: ${{ steps.meta.outputs.tags }}
build-args: BUILD_BASE_IMAGE=${{ steps.base_build.outputs.base_build_image }}
labels: |
org.opencontainers.image.revision=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
org.opencontainers.image.created=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
2024-02-08 16:44:14 +01:00
- name: Sign the images with GitHub OIDC Token
2024-02-17 15:24:24 +01:00
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
2024-02-08 16:44:14 +01:00
env:
DIGEST: ${{ steps.docker_build.outputs.digest }}
TAGS: ${{ steps.meta.outputs.tags }}
run: |
2024-02-19 10:28:42 +01:00
images=""
for tag in ${TAGS}; do
images+="${tag}@${DIGEST} "
done
2024-02-10 09:37:21 +01:00
echo "::group::Images to sign"
echo "$images"
echo "::endgroup::"
echo "::group::Signing"
echo "cosign sign --yes $images"
cosign sign --yes ${images}
echo "::endgroup::"
2024-02-08 16:44:14 +01:00
2024-05-30 13:36:54 +02:00
- name: Attest images
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
id: attest
uses: actions/attest-build-provenance@v1
with:
subject-name: ${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, matrix.build ) }}
subject-digest: ${{ steps.docker_build.outputs.digest }}
push-to-registry: true
2024-02-18 08:20:22 +01:00
- name: Image metadata
2024-02-19 06:57:53 +01:00
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
2024-02-08 17:59:21 +01:00
env:
2024-02-18 08:20:22 +01:00
METADATA: ${{ steps.docker_build.outputs.metadata }}
2024-02-10 09:37:21 +01:00
run: |
2024-02-18 08:20:22 +01:00
echo "::group::Image metadata"
echo "${METADATA}"
2024-02-10 09:37:21 +01:00
echo "::endgroup::"