extern/zrok
1
1
Fork 0
mirror of https://github.com/openziti/zrok.git synced 2025-06-24 11:41:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

publish container image attestations

Browse Source
This commit is contained in:
Kenneth Bingham 2025-02-24 15:35:21 -05:00
parent 8dd8392cb8
commit 86095fc205
No known key found for this signature in database
GPG Key ID: 31709281860130B6
1 changed files with 22 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
.github/workflows/publish-docker-images.yml vendored
View File

@ -11,13 +11,19 @@ on:
jobs: jobs:
publish-docker-images: publish-docker-images:
runs-on: ubuntu-24.04 runs-on: ubuntu-24.04
permissions:
contents: write # need write to draft the release
id-token: write # need write to get OIDC token for generating attestations
attestations: write # need write to create attestations
env: env:
REGISTRY: docker.io
RELEASE_REF: ${{ inputs.zrok-version }} RELEASE_REF: ${{ inputs.zrok-version }}
steps: steps:
# compose the semver string without leading "refs/tags" or "v" so we can predict the # compose the semver string without leading "refs/tags" or "v" so we can predict the
# release artifact filename # release artifact filename
- name: Set zrok Version Semver from Tag Ref - name: Set zrok Version Semver from Tag Ref
id: semver id: semver
shell: bash
run: | run: |
echo "zrok_semver=${RELEASE_REF#v}" | tee -a $GITHUB_OUTPUT echo "zrok_semver=${RELEASE_REF#v}" | tee -a $GITHUB_OUTPUT
@ -37,6 +43,7 @@ jobs:
path: dist/arm64/linux path: dist/arm64/linux
- name: Unpack the Release Artifacts - name: Unpack the Release Artifacts
shell: bash
run: | run: |
for TGZ in dist/{amd,arm}64/linux; do for TGZ in dist/{amd,arm}64/linux; do
tar -xvzf ${TGZ}/*.tar.gz -C ${TGZ} tar -xvzf ${TGZ}/*.tar.gz -C ${TGZ}
@ -54,6 +61,7 @@ jobs:
- name: Login to Docker Hub - name: Login to Docker Hub
uses: docker/login-action@v3 uses: docker/login-action@v3
with: with:
registry: ${{ env.REGISTRY}}
username: ${{ vars.DOCKER_HUB_API_USER || secrets.DOCKER_HUB_API_USER }} username: ${{ vars.DOCKER_HUB_API_USER || secrets.DOCKER_HUB_API_USER }}
password: ${{ secrets.DOCKER_HUB_API_TOKEN }} password: ${{ secrets.DOCKER_HUB_API_TOKEN }}
@ -62,14 +70,14 @@ jobs:
ZROK_CONTAINER_IMAGE_REPO: ${{ vars.ZROK_CONTAINER_IMAGE_REPO || 'openziti/zrok' }} ZROK_CONTAINER_IMAGE_REPO: ${{ vars.ZROK_CONTAINER_IMAGE_REPO || 'openziti/zrok' }}
ZROK_CONTAINER_IMAGE_TAG: ${{ steps.semver.outputs.zrok_semver }} ZROK_CONTAINER_IMAGE_TAG: ${{ steps.semver.outputs.zrok_semver }}
id: tagprep_cli id: tagprep_cli
shell: bash
run: | run: |
DOCKER_TAGS="${ZROK_CONTAINER_IMAGE_REPO}:${ZROK_CONTAINER_IMAGE_TAG}" DOCKER_TAGS="${ZROK_CONTAINER_IMAGE_REPO}:${ZROK_CONTAINER_IMAGE_TAG}"
echo "DOCKER_TAGS=${DOCKER_TAGS}" | tee -a $GITHUB_OUTPUT echo "DOCKER_TAGS=${DOCKER_TAGS}" | tee -a $GITHUB_OUTPUT
# this is the CLI image with the Linux binary for each
# arch that was downloaded in ./dist/
- name: Build & Push Multi-Platform CLI Container Image to Hub - name: Build & Push Multi-Platform CLI Container Image to Hub
uses: docker/build-push-action@v3 uses: docker/build-push-action@v6
id: push
with: with:
builder: ${{ steps.buildx.outputs.name }} builder: ${{ steps.buildx.outputs.name }}
context: ${{ github.workspace }}/ context: ${{ github.workspace }}/
@ -79,4 +87,15 @@ jobs:
build-args: | build-args: |
DOCKER_BUILD_DIR=./docker/images/zrok DOCKER_BUILD_DIR=./docker/images/zrok
ARTIFACTS_DIR=./dist ARTIFACTS_DIR=./dist
provenance: mode=max
sbom: true
push: true push: true
- name: Publish Attestations to GitHub
uses: actions/attest-build-provenance@v1
env:
IMAGE_REPO_TAG: ${{ vars.ZROK_CONTAINER_IMAGE_REPO || 'openziti/zrok' }}:${{ steps.semver.outputs.zrok_semver }}
with:
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_REPO_TAG}}
subject-digest: ${{ steps.push.outputs.digest }}
push-to-registry: true