Skip to content

Commit b3bac5a

Browse files
Nicolas-PeifferNicolas-Peiffer
committed
add github action
Signed-off-by: Nicolas-Peiffer <102670102+Nicolas-Peiffer@users.noreply.github.com>
1 parent d769209 commit b3bac5a

2 files changed

Lines changed: 242 additions & 0 deletions

File tree

‎.github/workflows/base-container-build.yaml‎

Lines changed: 242 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,242 @@
1+
# Using https://github.com/redhat-actions/buildah-build
2+
# doc https://github.com/marketplace/actions/buildah-build
3+
4+
name: "Build a container that ship with goreleaser, cosign, ko-build, trivy, syft and push to GitHub Container Registry (GHCR)"
5+
6+
on:
7+
pull_request:
8+
branches:
9+
- main
10+
- release/*
11+
push:
12+
branches:
13+
- main
14+
- buildah-redhat-ga # TODO: remove after testing
15+
16+
# Variables:
17+
# - BUILDAH_BUILD_CONTEXT is the path to the location of the Containerfile.
18+
# - BASE_CONTAINERFILE_NAME is name and location of the Containerfile for base image with a /bin/bash entrypoint.
19+
# - GOREL_ENTRYP_CONTAINERFILE_NAME is name and location of the Containerfile form image with ENTRYPOINT [ "/go/bin/goreleaser" ]
20+
env:
21+
BUILDAH_BUILD_CONTEXT: "${{ github.workspace }}"
22+
BASE_CONTAINERFILE_NAME: "Containerfile.base"
23+
OCI_REGISTRY: "ghcr.io" # must be lowercase
24+
25+
jobs:
26+
set-lowercase-repository:
27+
runs-on: ubuntu-latest
28+
outputs:
29+
lowercase-github-repository: ${{ steps.convert.outputs.lowercase }}
30+
steps:
31+
- name: Convert GitHub repository name to lowercase for OCI registry
32+
id: convert
33+
run: |
34+
echo "lowercase=$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
35+
shell: bash
36+
37+
show-lowercase-repository:
38+
needs: set-lowercase-repository
39+
runs-on: ubuntu-latest
40+
steps:
41+
- name: Access lowercase GitHub repository name
42+
run: |
43+
echo "Original Repository: ${{ github.repository }}"
44+
echo "Lowercase Repository: ${{ needs.set-lowercase-repository.outputs.lowercase-github-repository }}"
45+
46+
# buildah job with oci = true
47+
build-oci-true:
48+
needs: set-lowercase-repository
49+
runs-on: ubuntu-latest
50+
steps:
51+
- name: Checkout source code
52+
uses: actions/checkout@v5
53+
54+
- name: Extract Tools Versions from Containerfile as we use this in tags names
55+
id: extract
56+
run: |
57+
# Extract values from the Containerfile
58+
A_PARTICULAR_TAG_NAME=$(grep -m1 'ARG A_PARTICULAR_TAG_NAME=' $BUILDAH_BUILD_CONTEXT/$BASE_CONTAINERFILE_NAME | cut -d'=' -f2)
59+
echo "A_PARTICULAR_TAG_NAME=${A_PARTICULAR_TAG_NAME}" >> $GITHUB_OUTPUT
60+
61+
A_PARTICULAR_TAG_SEMVER=$(grep -m1 'ARG A_PARTICULAR_TAG_SEMVER=' $BUILDAH_BUILD_CONTEXT/$BASE_CONTAINERFILE_NAME | cut -d'=' -f2)
62+
echo "A_PARTICULAR_TAG_SEMVER=${A_PARTICULAR_TAG_SEMVER}" >> $GITHUB_OUTPUT
63+
64+
ALPINE_VERSION=$(grep -m1 'ARG ALPINE_VERSION=' $BUILDAH_BUILD_CONTEXT/$BASE_CONTAINERFILE_NAME | cut -d'=' -f2)
65+
echo "ALPINE_VERSION=${ALPINE_VERSION}" >> $GITHUB_OUTPUT
66+
67+
- uses: docker/login-action@v3
68+
id: docker-login
69+
with:
70+
registry: ${{ env.OCI_REGISTRY }}
71+
username: ${{ github.actor }}
72+
password: ${{ secrets.GITHUB_TOKEN }}
73+
74+
- name: Set OCI container image URL to Github output
75+
id: set-oci-image-url
76+
run: echo "OCI_IMAGE_URL=${{ env.OCI_REGISTRY }}/${{ needs.set-lowercase-repository.outputs.lowercase-github-repository }}-base" >> $GITHUB_OUTPUT
77+
78+
- name: Container metadata and tags with docker/metadata-action
79+
id: docker-metadata
80+
uses: docker/metadata-action@v5
81+
with:
82+
# image name may contain lowercase letters, digits and separators https://github.com/docker/metadata-action/tree/v5/?tab=readme-ov-file#image-name-and-tag-sanitization
83+
images: ${{ steps.set-oci-image-url.outputs.oci_image_url }}
84+
tags: |
85+
type=ref,event=branch
86+
# use tools version as tags
87+
type=raw,value=a-particular-tag-${{ steps.extract.outputs.a_particular_tag_name }}-oci
88+
type=raw,value=a-particular-tag-semver-${{ steps.extract.outputs.a_particular_tag_semver }}-oci
89+
type=raw,value=alpine-${{ steps.extract.outputs.alpine_version }}-oci
90+
91+
type=raw,value=a-particular-tag-${{ steps.extract.outputs.a_particular_tag_name }}-oci-alpine-${{ steps.extract.outputs.alpine_version }}
92+
type=raw,value=a-particular-tag-semver-${{ steps.extract.outputs.a_particular_tag_semver }}-oci-alpine-${{ steps.extract.outputs.alpine_version }}
93+
94+
# minimal (short sha)
95+
type=sha
96+
# full length sha
97+
type=sha,format=long
98+
99+
- name: Build the OCI image buildah oci true
100+
id: buildah
101+
uses: redhat-actions/buildah-build@v2
102+
with:
103+
#context: ${{ env.BUILDAH_BUILD_CONTEXT }}
104+
containerfiles: |
105+
${{ env.BASE_CONTAINERFILE_NAME }}
106+
layers: true
107+
oci: true
108+
tags: ${{ steps.docker-metadata.outputs.tags }}
109+
#labels: ${{ steps.docker-metadata.outputs.labels }}
110+
111+
- name: Check images created by buildah
112+
run: buildah images
113+
114+
- name: push to ghcr registry with redhat-actions/push-to-registry
115+
id: push-to-ghcr
116+
uses: redhat-actions/push-to-registry@v2
117+
with:
118+
image: ${{ steps.set-oci-image-url.outputs.oci_image_url }} # needs to be lowercase
119+
tags: ${{ steps.buildah.outputs.tags }}
120+
registry: ${{ env.OCI_REGISTRY }}
121+
username: ${{ github.actor }}
122+
password: ${{ secrets.GITHUB_TOKEN }}
123+
124+
outputs:
125+
oci-image-digest: ${{ steps.buildah.outputs.digest }}
126+
oci-image-url: ${{ steps.set-oci-image-url.outputs.oci_image_url }} # needs to be lowercase
127+
128+
# buildah job with oci = false
129+
build-oci-false:
130+
needs: set-lowercase-repository
131+
runs-on: ubuntu-latest
132+
steps:
133+
- name: Checkout source code
134+
uses: actions/checkout@v5
135+
136+
- name: Extract Tools Versions from Containerfile as we use this in tags names
137+
id: extract
138+
run: |
139+
# Extract values from the Containerfile
140+
A_PARTICULAR_TAG_NAME=$(grep -m1 'ARG A_PARTICULAR_TAG_NAME=' $BUILDAH_BUILD_CONTEXT/$BASE_CONTAINERFILE_NAME | cut -d'=' -f2)
141+
echo "A_PARTICULAR_TAG_NAME=${A_PARTICULAR_TAG_NAME}" >> $GITHUB_OUTPUT
142+
143+
A_PARTICULAR_TAG_SEMVER=$(grep -m1 'ARG A_PARTICULAR_TAG_SEMVER=' $BUILDAH_BUILD_CONTEXT/$BASE_CONTAINERFILE_NAME | cut -d'=' -f2)
144+
echo "A_PARTICULAR_TAG_SEMVER=${A_PARTICULAR_TAG_SEMVER}" >> $GITHUB_OUTPUT
145+
146+
ALPINE_VERSION=$(grep -m1 'ARG ALPINE_VERSION=' $BUILDAH_BUILD_CONTEXT/$BASE_CONTAINERFILE_NAME | cut -d'=' -f2)
147+
echo "ALPINE_VERSION=${ALPINE_VERSION}" >> $GITHUB_OUTPUT
148+
149+
- uses: docker/login-action@v3
150+
id: docker-login
151+
with:
152+
registry: ${{ env.OCI_REGISTRY }}
153+
username: ${{ github.actor }}
154+
password: ${{ secrets.GITHUB_TOKEN }}
155+
156+
- name: Set OCI container image URL to Github output
157+
id: set-oci-image-url
158+
run: echo "OCI_IMAGE_URL=${{ env.OCI_REGISTRY }}/${{ needs.set-lowercase-repository.outputs.lowercase-github-repository }}-base" >> $GITHUB_OUTPUT
159+
160+
- name: Container metadata and tags with docker/metadata-action
161+
id: docker-metadata
162+
uses: docker/metadata-action@v5
163+
with:
164+
# image name may contain lowercase letters, digits and separators https://github.com/docker/metadata-action/tree/v5/?tab=readme-ov-file#image-name-and-tag-sanitization
165+
images: ${{ steps.set-oci-image-url.outputs.oci_image_url }}
166+
tags: |
167+
type=ref,event=branch
168+
# use tools version as tags
169+
type=raw,value=a-particular-tag-${{ steps.extract.outputs.a_particular_tag_name }}-dockerv2
170+
type=raw,value=a-particular-tag-semver-${{ steps.extract.outputs.a_particular_tag_semver }}-dockerv2
171+
type=raw,value=alpine-${{ steps.extract.outputs.alpine_version }}-dockerv2
172+
173+
type=raw,value=a-particular-tag-${{ steps.extract.outputs.a_particular_tag_name }}-dockerv2-alpine-${{ steps.extract.outputs.alpine_version }}
174+
type=raw,value=a-particular-tag-semver-${{ steps.extract.outputs.a_particular_tag_semver }}-dockerv2-alpine-${{ steps.extract.outputs.alpine_version }}
175+
176+
# minimal (short sha)
177+
type=sha
178+
# full length sha
179+
type=sha,format=long
180+
181+
- name: Build the OCI image buildah oci false
182+
id: buildah
183+
uses: redhat-actions/buildah-build@v2
184+
with:
185+
#context: ${{ env.BUILDAH_BUILD_CONTEXT }}
186+
containerfiles: |
187+
${{ env.BASE_CONTAINERFILE_NAME }}
188+
layers: true
189+
oci: false
190+
tags: ${{ steps.docker-metadata.outputs.tags }}
191+
#labels: ${{ steps.docker-metadata.outputs.labels }}
192+
193+
- name: Check images created by buildah
194+
run: buildah images
195+
196+
- name: push to ghcr registry with redhat-actions/push-to-registry
197+
id: push-to-ghcr
198+
uses: redhat-actions/push-to-registry@v2
199+
with:
200+
image: ${{ steps.set-oci-image-url.outputs.oci_image_url }} # needs to be lowercase
201+
tags: ${{ steps.buildah.outputs.tags }}
202+
registry: ${{ env.OCI_REGISTRY }}
203+
username: ${{ github.actor }}
204+
password: ${{ secrets.GITHUB_TOKEN }}
205+
206+
outputs:
207+
oci-image-digest: ${{ steps.buildah.outputs.digest }}
208+
oci-image-url: ${{ steps.set-oci-image-url.outputs.oci_image_url }} # needs to be lowercase
209+
210+
211+
# Job to build a SLSA provenance attestation
212+
base-image-provenance:
213+
name: Generate SLSA provenance attestation for OCI (base image entrypoint /bin/bash)
214+
needs: [build-oci-true, set-lowercase-repository] # Ensure this job runs after build-oci-true
215+
permissions:
216+
actions: read # for detecting the Github Actions environment.
217+
id-token: write # for creating OIDC tokens for signing. Required for SLSA and Cosign
218+
packages: write # for uploading attestations. (https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#known-issues)
219+
# Must be referenced by a tag. https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#referencing-the-slsa-generator
220+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0
221+
with:
222+
image: ${{ needs.build-oci-true.outputs.oci-image-url }} # needs to be lowercase
223+
digest: ${{ needs.build-oci-true.outputs.oci-image-digest }}
224+
secrets:
225+
registry-username: ${{ github.actor }}
226+
registry-password: ${{ secrets.GITHUB_TOKEN }}
227+
228+
goreleaser-entryp-image-provenance:
229+
name: Generate SLSA provenance attestation for OCI (entrypoint goreleaser)
230+
needs: [build-oci-false] # Ensure this job runs after build-oci-true
231+
permissions:
232+
actions: read # for detecting the Github Actions environment.
233+
id-token: write # for creating OIDC tokens for signing. Required for SLSA and Cosign
234+
packages: write # for uploading attestations. (https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#known-issues)
235+
# Must be referenced by a tag. https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#referencing-the-slsa-generator
236+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0
237+
with:
238+
image: ${{ needs.build-oci-false.outputs.oci-image-url }} # needs to be lowercase
239+
digest: ${{ needs.build-oci-false.outputs.oci-image-digest }}
240+
secrets:
241+
registry-username: ${{ github.actor }}
242+
registry-password: ${{ secrets.GITHUB_TOKEN }}

Containerfile renamed to Containerfile.base

File renamed without changes.

0 commit comments

Comments
 (0)