Skip to content

Commit 84877ef

Browse files
crazy-maxcrazy-max
committed
verify reusable workflow
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
1 parent 6a09854 commit 84877ef

File tree

5 files changed

+235
-177
lines changed

5 files changed

+235
-177
lines changed

‎.github/workflows/.test.yml‎

Lines changed: 140 additions & 133 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,19 @@ jobs:
3939
username: ${{ secrets.AWS_ACCESS_KEY_ID }}
4040
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
4141
42+
build-aws-single-verify:
43+
uses: ./.github/workflows/verify.yml
44+
if: ${{ github.event_name != 'pull_request' }}
45+
needs:
46+
- build-aws-single
47+
with:
48+
builder-outputs: ${{ toJSON(needs.build-aws-single.outputs) }}
49+
secrets:
50+
registry-auths: |
51+
- registry: public.ecr.aws
52+
username: ${{ secrets.AWS_ACCESS_KEY_ID }}
53+
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
54+
4255
build-aws:
4356
uses: ./.github/workflows/build.yml
4457
permissions:
@@ -63,37 +76,17 @@ jobs:
6376
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
6477
6578
build-aws-verify:
66-
runs-on: ubuntu-latest
79+
uses: ./.github/workflows/verify.yml
6780
if: ${{ github.event_name != 'pull_request' }}
6881
needs:
6982
- build-aws
70-
steps:
71-
-
72-
name: Install Cosign
73-
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
74-
with:
75-
cosign-release: ${{ needs.build-aws.outputs.cosign-version }}
76-
-
77-
name: Login to registry
78-
uses: docker/login-action@v3
79-
with:
80-
registry: public.ecr.aws
83+
with:
84+
builder-outputs: ${{ toJSON(needs.build-aws.outputs) }}
85+
secrets:
86+
registry-auths: |
87+
- registry: public.ecr.aws
8188
username: ${{ secrets.AWS_ACCESS_KEY_ID }}
8289
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
83-
-
84-
name: Verify signatures
85-
uses: actions/github-script@v8
86-
env:
87-
INPUT_COSIGN-VERSION: ${{ needs.build-aws.outputs.cosign-version }}
88-
INPUT_COSIGN-VERIFY-COMMANDS: ${{ needs.build-aws.outputs.cosign-verify-commands }}
89-
with:
90-
script: |
91-
const cosignVersion = core.getInput('cosign-version');
92-
core.info(`Cosign version used by Docker GitHub Builder: ${cosignVersion}`);
93-
const cosignVerifyCommands = core.getMultilineInput('cosign-verify-commands');
94-
for (const cmd of cosignVerifyCommands) {
95-
await exec.exec(cmd);
96-
}
9790
9891
build-ghcr:
9992
uses: ./.github/workflows/build.yml
@@ -115,6 +108,19 @@ jobs:
115108
username: ${{ github.actor }}
116109
password: ${{ secrets.GITHUB_TOKEN }}
117110
111+
build-ghcr-verify:
112+
uses: ./.github/workflows/verify.yml
113+
if: ${{ github.event_name != 'pull_request' }}
114+
needs:
115+
- build-ghcr
116+
with:
117+
builder-outputs: ${{ toJSON(needs.build-ghcr.outputs) }}
118+
secrets:
119+
registry-auths: |
120+
- registry: ghcr.io
121+
username: ${{ github.actor }}
122+
password: ${{ secrets.GITHUB_TOKEN }}
123+
118124
build-dockerhub-stage:
119125
uses: ./.github/workflows/build.yml
120126
permissions:
@@ -135,6 +141,19 @@ jobs:
135141
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
136142
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}
137143
144+
build-dockerhub-stage-verify:
145+
uses: ./.github/workflows/verify.yml
146+
if: ${{ github.event_name != 'pull_request' }}
147+
needs:
148+
- build-dockerhub-stage
149+
with:
150+
builder-outputs: ${{ toJSON(needs.build-dockerhub-stage.outputs) }}
151+
secrets:
152+
registry-auths: |
153+
- registry: registry-1-stage.docker.io
154+
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
155+
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}
156+
138157
build-dockerhub-stage-oidc:
139158
uses: ./.github/workflows/build.yml
140159
permissions:
@@ -154,6 +173,18 @@ jobs:
154173
- registry: registry-1-stage.docker.io
155174
username: docker:cdeb5882-30b7-4076-be92-bfdceb258e9c
156175
176+
build-dockerhub-stage-oidc-verify:
177+
uses: ./.github/workflows/verify.yml
178+
if: ${{ github.event_name != 'pull_request' }}
179+
needs:
180+
- build-dockerhub-stage-oidc
181+
with:
182+
builder-outputs: ${{ toJSON(needs.build-dockerhub-stage-oidc.outputs) }}
183+
secrets:
184+
registry-auths: |
185+
- registry: registry-1-stage.docker.io
186+
username: docker:cdeb5882-30b7-4076-be92-bfdceb258e9c
187+
157188
build-ghcr-and-aws:
158189
uses: ./.github/workflows/build.yml
159190
permissions:
@@ -179,6 +210,22 @@ jobs:
179210
username: ${{ secrets.AWS_ACCESS_KEY_ID }}
180211
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
181212
213+
build-ghcr-and-aws-verify:
214+
uses: ./.github/workflows/verify.yml
215+
if: ${{ github.event_name != 'pull_request' }}
216+
needs:
217+
- build-ghcr-and-aws
218+
with:
219+
builder-outputs: ${{ toJSON(needs.build-ghcr-and-aws.outputs) }}
220+
secrets:
221+
registry-auths: |
222+
- registry: ghcr.io
223+
username: ${{ github.actor }}
224+
password: ${{ secrets.GITHUB_TOKEN }}
225+
- registry: public.ecr.aws
226+
username: ${{ secrets.AWS_ACCESS_KEY_ID }}
227+
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
228+
182229
build-local:
183230
uses: ./.github/workflows/build.yml
184231
permissions:
@@ -193,35 +240,12 @@ jobs:
193240
build-platforms: linux/amd64,linux/arm64
194241

195242
build-local-verify:
196-
runs-on: ubuntu-latest
243+
uses: ./.github/workflows/verify.yml
197244
if: ${{ github.event_name != 'pull_request' }}
198245
needs:
199246
- build-local
200-
steps:
201-
-
202-
name: Install Cosign
203-
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
204-
with:
205-
cosign-release: ${{ needs.build-local.outputs.cosign-version }}
206-
-
207-
name: Download artifact
208-
uses: actions/download-artifact@v5
209-
with:
210-
name: ${{ needs.build-local.outputs.artifact-name }}
211-
-
212-
name: Verify signatures
213-
uses: actions/github-script@v8
214-
env:
215-
INPUT_COSIGN-VERSION: ${{ needs.build-local.outputs.cosign-version }}
216-
INPUT_COSIGN-VERIFY-COMMANDS: ${{ needs.build-local.outputs.cosign-verify-commands }}
217-
with:
218-
script: |
219-
const cosignVersion = core.getInput('cosign-version');
220-
core.info(`Cosign version used by Docker GitHub Builder: ${cosignVersion}`);
221-
const cosignVerifyCommands = core.getMultilineInput('cosign-verify-commands');
222-
for (const cmd of cosignVerifyCommands) {
223-
await exec.exec(cmd);
224-
}
247+
with:
248+
builder-outputs: ${{ toJSON(needs.build-local.outputs) }}
225249

226250
build-local-single:
227251
uses: ./.github/workflows/build.yml
@@ -235,6 +259,50 @@ jobs:
235259
build-file: test/hello.Dockerfile
236260
build-sbom: true
237261

262+
build-local-single-verify:
263+
uses: ./.github/workflows/verify.yml
264+
if: ${{ github.event_name != 'pull_request' }}
265+
needs:
266+
- build-local-single
267+
with:
268+
builder-outputs: ${{ toJSON(needs.build-local-single.outputs) }}
269+
270+
bake-aws-single:
271+
uses: ./.github/workflows/bake.yml
272+
permissions:
273+
contents: read
274+
packages: write
275+
id-token: write
276+
with:
277+
context: test
278+
target: hello
279+
output: ${{ github.event_name != 'pull_request' && 'registry' || 'cacheonly' }}
280+
cache: true
281+
cache-scope: bake-aws
282+
meta-images: |
283+
public.ecr.aws/q3b5f1u4/test-docker-action
284+
meta-tags: |
285+
type=raw,value=bake-ghbuilder-single-${{ github.run_id }}
286+
bake-sbom: true
287+
secrets:
288+
registry-auths: |
289+
- registry: public.ecr.aws
290+
username: ${{ secrets.AWS_ACCESS_KEY_ID }}
291+
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
292+
293+
bake-aws-single-verify:
294+
uses: ./.github/workflows/verify.yml
295+
if: ${{ github.event_name != 'pull_request' }}
296+
needs:
297+
- bake-aws-single
298+
with:
299+
builder-outputs: ${{ toJSON(needs.bake-aws-single.outputs) }}
300+
secrets:
301+
registry-auths: |
302+
- registry: public.ecr.aws
303+
username: ${{ secrets.AWS_ACCESS_KEY_ID }}
304+
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
305+
238306
bake-aws:
239307
uses: ./.github/workflows/bake.yml
240308
permissions:
@@ -259,37 +327,17 @@ jobs:
259327
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
260328
261329
bake-aws-verify:
262-
runs-on: ubuntu-latest
330+
uses: ./.github/workflows/verify.yml
263331
if: ${{ github.event_name != 'pull_request' }}
264332
needs:
265333
- bake-aws
266-
steps:
267-
-
268-
name: Install Cosign
269-
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
270-
with:
271-
cosign-release: ${{ needs.bake-aws.outputs.cosign-version }}
272-
-
273-
name: Login to registry
274-
uses: docker/login-action@v3
275-
with:
276-
registry: public.ecr.aws
334+
with:
335+
builder-outputs: ${{ toJSON(needs.bake-aws.outputs) }}
336+
secrets:
337+
registry-auths: |
338+
- registry: public.ecr.aws
277339
username: ${{ secrets.AWS_ACCESS_KEY_ID }}
278340
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
279-
-
280-
name: Verify signatures
281-
uses: actions/github-script@v8
282-
env:
283-
INPUT_COSIGN-VERSION: ${{ needs.bake-aws.outputs.cosign-version }}
284-
INPUT_COSIGN-VERIFY-COMMANDS: ${{ needs.bake-aws.outputs.cosign-verify-commands }}
285-
with:
286-
script: |
287-
const cosignVersion = core.getInput('cosign-version');
288-
core.info(`Cosign version used by Docker GitHub Builder: ${cosignVersion}`);
289-
const cosignVerifyCommands = core.getMultilineInput('cosign-verify-commands');
290-
for (const cmd of cosignVerifyCommands) {
291-
await exec.exec(cmd);
292-
}
293341
294342
bake-ghcr-and-aws:
295343
uses: ./.github/workflows/bake.yml
@@ -319,37 +367,12 @@ jobs:
319367
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
320368
321369
bake-ghcr-and-aws-verify:
322-
runs-on: ubuntu-latest
370+
uses: ./.github/workflows/verify.yml
323371
if: ${{ github.event_name != 'pull_request' }}
324372
needs:
325373
- bake-ghcr-and-aws
326-
steps:
327-
-
328-
name: Install Cosign
329-
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
330-
with:
331-
cosign-release: ${{ needs.bake-ghcr-and-aws.outputs.cosign-version }}
332-
-
333-
name: Login to registry
334-
uses: docker/login-action@v3
335-
with:
336-
registry: public.ecr.aws
337-
username: ${{ secrets.AWS_ACCESS_KEY_ID }}
338-
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
339-
-
340-
name: Verify signatures
341-
uses: actions/github-script@v8
342-
env:
343-
INPUT_COSIGN-VERSION: ${{ needs.bake-ghcr-and-aws.outputs.cosign-version }}
344-
INPUT_COSIGN-VERIFY-COMMANDS: ${{ needs.bake-ghcr-and-aws.outputs.cosign-verify-commands }}
345-
with:
346-
script: |
347-
const cosignVersion = core.getInput('cosign-version');
348-
core.info(`Cosign version used by Docker GitHub Builder: ${cosignVersion}`);
349-
const cosignVerifyCommands = core.getMultilineInput('cosign-verify-commands');
350-
for (const cmd of cosignVerifyCommands) {
351-
await exec.exec(cmd);
352-
}
374+
with:
375+
builder-outputs: ${{ toJSON(needs.bake-ghcr-and-aws.outputs) }}
353376

354377
bake-local:
355378
uses: ./.github/workflows/bake.yml
@@ -366,36 +389,12 @@ jobs:
366389
bake-sbom: true
367390

368391
bake-local-verify:
369-
runs-on: ubuntu-latest
392+
uses: ./.github/workflows/verify.yml
370393
if: ${{ github.event_name != 'pull_request' }}
371394
needs:
372395
- bake-local
373-
steps:
374-
-
375-
name: Install Cosign
376-
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
377-
with:
378-
cosign-release: ${{ needs.bake-local.outputs.cosign-version }}
379-
-
380-
name: Download artifacts
381-
uses: actions/download-artifact@v5
382-
with:
383-
pattern: ${{ needs.bake-local.outputs.artifact-name }}*
384-
merge-multiple: true
385-
-
386-
name: Verify signatures
387-
uses: actions/github-script@v8
388-
env:
389-
INPUT_COSIGN-VERSION: ${{ needs.bake-local.outputs.cosign-version }}
390-
INPUT_COSIGN-VERIFY-COMMANDS: ${{ needs.bake-local.outputs.cosign-verify-commands }}
391-
with:
392-
script: |
393-
const cosignVersion = core.getInput('cosign-version');
394-
core.info(`Cosign version used by Docker GitHub Builder: ${cosignVersion}`);
395-
const cosignVerifyCommands = core.getMultilineInput('cosign-verify-commands');
396-
for (const cmd of cosignVerifyCommands) {
397-
await exec.exec(cmd);
398-
}
396+
with:
397+
builder-outputs: ${{ toJSON(needs.bake-local.outputs) }}
399398

400399
bake-local-single:
401400
uses: ./.github/workflows/bake.yml
@@ -410,3 +409,11 @@ jobs:
410409
cache: true
411410
artifact-name: bake-output-single
412411
bake-sbom: true
412+
413+
bake-local-single-verify:
414+
uses: ./.github/workflows/verify.yml
415+
if: ${{ github.event_name != 'pull_request' }}
416+
needs:
417+
- bake-local-single
418+
with:
419+
builder-outputs: ${{ toJSON(needs.bake-local-single.outputs) }}

‎.github/workflows/bake.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,9 @@ on:
129129
artifact-name:
130130
description: Name of the uploaded artifact (for local output)
131131
value: ${{ jobs.finalize.outputs.artifact-name }}
132+
output-type:
133+
description: Build output type
134+
value: ${{ jobs.finalize.outputs.output-type }}
132135

133136
env:
134137
DOCKER_ACTIONS_TOOLKIT_MODULE: "@docker/actions-toolkit@0.67.0"
@@ -635,6 +638,7 @@ jobs:
635638
cosign-version: ${{ env.COSIGN_VERSION }}
636639
cosign-verify-commands: ${{ steps.set.outputs.cosign-verify-commands }}
637640
artifact-name: ${{ inputs.artifact-name }}
641+
output-type: ${{ inputs.output }}
638642
needs:
639643
- build
640644
steps:

0 commit comments

Comments
 (0)