Skip to content

Commit 2b382f2

Browse files
dminnear-rhdminnear-rh
authored
Merge pull request #42 from dminnear-rh/push-to-both-quay-orgs
update github actions workflows for imperative container
2 parents 5b3d013 + 2810f4b commit 2b382f2

7 files changed

Lines changed: 152 additions & 171 deletions

File tree

‎.github/linters/.yaml-lint.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ ignore: |
88
99
rules:
1010
truthy:
11-
allowed-values: ['true', 'false']
11+
allowed-values: ["true", "false"]
1212
check-keys: false
1313
level: error
1414
line-length: disable

‎.github/workflows/container-test.yml‎

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎.github/workflows/docker-publish.yml‎

Lines changed: 106 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,74 @@
1-
---
2-
name: Docker build and push to quay
3-
4-
# This workflow uses actions that are not certified by GitHub.
5-
# They are provided by a third-party and are governed by
6-
# separate terms of service, privacy policy, and support
7-
# documentation.
8-
permissions: read-all
1+
name: Build (amd64 and arm64) and push to quay registries
92

103
on:
114
push:
12-
branches: ['main', 'v1']
13-
# Publish semver tags as releases.
14-
tags: ['v*.*.*']
5+
branches: ["main"]
6+
tags: ["v*.*.*"]
157
pull_request:
168
branches: ["main"]
179

1810
workflow_dispatch:
1911

20-
env:
21-
# Use docker.io for Docker Hub if empty
22-
REGISTRY: quay.io
23-
# The following is stored in a per-repo env config variable
24-
# github.repository as <account>/<repo>
25-
# QUAY_IMAGE_NAME: hybridcloudpatterns/imperative-container
12+
repository_dispatch:
13+
types: [dependency-updated]
14+
15+
permissions:
16+
contents: read
2617

18+
env:
19+
REGISTRY: localhost
20+
NAME: imperative-container
21+
TAG: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || (github.ref_name == 'main' && 'latest' || github.ref_name) }}
2722

2823
jobs:
29-
test:
30-
uses: ./.github/workflows/container-test.yml
24+
build-container:
25+
strategy:
26+
matrix:
27+
include:
28+
- targetarch: amd64
29+
runner: ubuntu-latest
30+
- targetarch: arm64
31+
runner: ubuntu-24.04-arm
32+
33+
runs-on: ${{ matrix.runner }}
34+
permissions:
35+
contents: read
36+
37+
steps:
38+
- name: Checkout repository
39+
uses: actions/checkout@v5
40+
with:
41+
persist-credentials: false
42+
43+
- name: Build container and save tarball
44+
env:
45+
CONTAINER: ${{ env.NAME }}:${{ env.TAG }}
46+
TARGETARCH: ${{ matrix.targetarch }}
47+
run: |
48+
make "${TARGETARCH}"
49+
buildah push "${CONTAINER}-${TARGETARCH}" "docker-archive:/tmp/image-${TARGETARCH}.tar:${CONTAINER}-${TARGETARCH}"
50+
51+
- name: Upload image artifact
52+
uses: actions/upload-artifact@v4
53+
with:
54+
name: image-${{ matrix.targetarch }}-${{ github.run_id }}
55+
path: /tmp/image-${{ matrix.targetarch }}.tar
56+
retention-days: 1
57+
58+
push-multiarch-manifest:
59+
needs: [build-container]
60+
if: github.event_name != 'pull_request'
61+
strategy:
62+
matrix:
63+
include:
64+
- upload_registry: quay.io/validatedpatterns
65+
legacy: false
66+
- upload_registry: quay.io/hybridcloudpatterns
67+
legacy: true
3168

32-
build-container-and-push:
33-
needs: [test]
3469
runs-on: ubuntu-latest
3570
permissions:
3671
contents: read
37-
packages: write
3872
# This is used to complete the identity challenge
3973
# with sigstore/fulcio when running outside of PRs.
4074
id-token: write
@@ -45,71 +79,57 @@ jobs:
4579
with:
4680
persist-credentials: false
4781

48-
- name: Set up QEMU
49-
uses: docker/setup-qemu-action@v3
50-
51-
# Install the cosign tool except on PR
52-
# https://github.com/sigstore/cosign-installer
53-
- name: Install cosign
54-
if: github.event_name != 'pull_request'
55-
uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
56-
with:
57-
cosign-release: 'v2.2.4'
58-
59-
# Set up BuildKit Docker container builder to be able to build
60-
# multi-platform images and export cache
61-
# https://github.com/docker/setup-buildx-action
62-
- name: Set up Docker Buildx
63-
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
64-
65-
# Login against a Docker registry except on PR
66-
# https://github.com/docker/login-action
67-
- name: Log into registry ${{ env.REGISTRY }}
68-
if: github.event_name != 'pull_request'
69-
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
82+
- name: Download AMD64 image
83+
uses: actions/download-artifact@v5
7084
with:
71-
registry: ${{ env.REGISTRY }}
72-
username: ${{ secrets.QUAY_USERNAME }}
73-
password: ${{ secrets.QUAY_PASSWORD }}
74-
75-
# Extract metadata (tags, labels) for Docker
76-
# https://github.com/docker/metadata-action
77-
# We add the latest tag only when we are on the main branch
78-
- name: Extract Docker metadata
79-
id: meta
80-
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
85+
name: image-amd64-${{ github.run_id }}
86+
path: /tmp
87+
88+
- name: Download ARM64 image
89+
uses: actions/download-artifact@v5
8190
with:
82-
images: ${{ env.REGISTRY }}/${{ vars.QUAY_IMAGE_NAME || 'hybridcloudpatterns/imperative-container' }}
83-
flavor: |
84-
latest=${{ github.ref == 'refs/heads/main' }}
85-
86-
# https://github.com/docker/build-push-action
87-
# Build Docker image with Buildx. We always disable the cache as
88-
# it sometimes would not pull the new git changes for the cluster_utils,v1
89-
# We only push to an actual registry when it is not a pull request (merge/push)
90-
- name: Build and push Docker image
91-
id: build-and-push
92-
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
91+
name: image-arm64-${{ github.run_id }}
92+
path: /tmp
93+
94+
- name: Load tarballs into local containers-storage
95+
run: |
96+
buildah pull docker-archive:/tmp/image-amd64.tar
97+
buildah pull docker-archive:/tmp/image-arm64.tar
98+
99+
- name: Log into Quay
100+
env:
101+
USERNAME: ${{ matrix.legacy && secrets.LEGACY_QUAY_USERNAME || secrets.QUAY_USERNAME }}
102+
PASSWORD: ${{ matrix.legacy && secrets.LEGACY_QUAY_PASSWORD || secrets.QUAY_PASSWORD }}
103+
run: |
104+
buildah login -u "${USERNAME}" -p "${PASSWORD}" quay.io
105+
106+
# The compressed manifest in Quay has a different digest than the local so we
107+
# need to use skopeo to retrieve the correct digest for signing
108+
- name: Create manifest and push to Quay
109+
id: manifest-push
110+
env:
111+
UPLOADREGISTRY: ${{ matrix.upload_registry }}
112+
CONTAINER: ${{ env.NAME }}:${{ env.TAG }}
113+
run: |
114+
make manifest
115+
buildah manifest add --arch=amd64 "${REGISTRY}/${CONTAINER}" "${REGISTRY}/${CONTAINER}-amd64"
116+
buildah manifest add --arch=arm64 "${REGISTRY}/${CONTAINER}" "${REGISTRY}/${CONTAINER}-arm64"
117+
make upload
118+
DIGEST=$(skopeo inspect --format "{{.Digest}}" "docker://${UPLOADREGISTRY}/${CONTAINER}")
119+
echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
120+
121+
- name: Install cosign
122+
uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
93123
with:
94-
context: .
95-
file: Containerfile
96-
platforms: linux/amd64,linux/arm64
97-
push: ${{ github.event_name != 'pull_request' }}
98-
tags: ${{ steps.meta.outputs.tags }}
99-
labels: ${{ steps.meta.outputs.labels }}
100-
no-cache: true
101-
102-
# Sign the resulting Docker image digest except on PRs.
103-
# This will only write to the public Rekor transparency log when the Docker
104-
# repository is public to avoid leaking data. If you would like to publish
105-
# transparency data even for private images, pass --force to cosign below.
106-
# https://github.com/sigstore/cosign
107-
- name: Sign the published Docker image when not a PR
108-
if: ${{ github.event_name != 'pull_request' }}
124+
cosign-release: "v2.2.4"
125+
126+
# Cosign expects the docker config.json for registry authentication so we must
127+
# copy it from buildah
128+
- name: Sign the published Docker image
109129
env:
110-
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
111-
TAGS: ${{ steps.meta.outputs.tags }}
112-
DIGEST: ${{ steps.build-and-push.outputs.digest }}
113-
# This step uses the identity token to provision an ephemeral certificate
114-
# against the sigstore community Fulcio instance.
115-
run: echo "${TAGS}" | xargs -I "{}" cosign sign --yes "{}@${DIGEST}"
130+
CONTAINER: ${{ env.NAME }}:${{ env.TAG }}
131+
DIGEST: ${{ steps.manifest-push.outputs.digest }}
132+
UPLOADREGISTRY: ${{ matrix.upload_registry }}
133+
run: |
134+
cat "${XDG_RUNTIME_DIR}/containers/auth.json" > ~/.docker/config.json
135+
cosign sign --yes "${UPLOADREGISTRY}/${CONTAINER}@${DIGEST}"

‎.github/workflows/superlinter.yml‎

Lines changed: 11 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,15 @@
1-
---
21
name: Super linter
32

4-
on: [push, pull_request]
5-
permissions: read-all
3+
on:
4+
pull_request:
5+
branches: [main]
66

7-
jobs:
8-
build:
9-
# Name the Job
10-
name: Super linter
11-
# Set the agent to run on
12-
runs-on: ubuntu-latest
13-
14-
steps:
15-
- name: Checkout Code
16-
uses: actions/checkout@v5
17-
with:
18-
# Full git history is needed to get a proper list of changed files within `super-linter`
19-
fetch-depth: 0
20-
persist-credentials: false
7+
permissions:
8+
contents: read
219

22-
################################
23-
# Run Linter against code base #
24-
################################
25-
- name: Lint Code Base
26-
uses: super-linter/super-linter/slim@v8
27-
env:
28-
VALIDATE_ALL_CODEBASE: true
29-
DEFAULT_BRANCH: main
30-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
31-
# These are the validation we disable atm
32-
VALIDATE_GITHUB_ACTIONS_ZIZMOR: false
33-
VALIDATE_MARKDOWN_PRETTIER: false
34-
VALIDATE_NATURAL_LANGUAGE: false
35-
VALIDATE_SHELL_SHFMT: false
36-
VALIDATE_TRIVY: false
37-
VALIDATE_YAML_PRETTIER: false
38-
# VALIDATE_DOCKERFILE_HADOLINT: false
39-
# VALIDATE_NATURAL_LANGUAGE: false
40-
# VALIDATE_TEKTON: false
10+
jobs:
11+
lint:
12+
uses: validatedpatterns/github-actions-library/.github/workflows/superlinter.yml@v1
13+
with:
14+
sl_env: |
15+
VALIDATE_TRIVY=false

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ build: manifest podman-build test ## Build the container locally (all arches) an
3232
amd64: manifest podman-build-amd64 test-amd64 ## Build and test the container on amd64
3333

3434
.PHONY: arm64
35-
arm64: manifest podman-build-amd64 test-amd64 ## Build and test the container on amd64
35+
arm64: manifest podman-build-arm64 test-arm64 ## Build and test the container on amd64
3636

3737
.PHONY: manifest
3838
manifest: ## creates the buildah manifest for multi-arch images

‎README.md‎

Lines changed: 27 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -8,29 +8,32 @@ An imperative container for simplified execution of imperative commands in each
88

99
This container provides a focused environment with essential tools for executing imperative commands and automation tasks in Validated Patterns. It includes Ansible, Kubernetes tools, and other utilities needed for pattern implementation and management.
1010

11-
1211
## Installed Software
1312

14-
| name | type |version|
15-
|:----------------:|:--------:|:-----:|
16-
|ansible |pip |2.16.14|
17-
|ansible.posix |collection|2.1.0 |
18-
|ansible-runner |pip |2.4.1 |
19-
|ansible.utils |collection|6.0.0 |
20-
|community.general |collection|11.2.1 |
21-
|community.okd |collection|5.0.0 |
22-
|git-core |package |2.47.3 |
23-
|gzip |package |1.12 |
24-
|jmespath |pip |1.0.1 |
25-
|jq |package |1.6 |
26-
|kubernetes.core |collection|6.1.0 |
27-
|kubernetes |pip |33.1.0 |
28-
|make |package |4.3 |
29-
|openshift |binary |4.16.14|
30-
|python3-pip |package |21.3.1 |
31-
|python |package |3.11.11|
32-
|rhvp.cluster_utils|collection|1.1.0 |
33-
|sshpass |package |1.09 |
13+
<!-- textlint-disable -->
14+
15+
| name | type | version |
16+
| :----------------: | :--------: | :-----: |
17+
| ansible | pip | 2.16.14 |
18+
| ansible.posix | collection | 2.1.0 |
19+
| ansible-runner | pip | 2.4.1 |
20+
| ansible.utils | collection | 6.0.0 |
21+
| community.general | collection | 11.3.0 |
22+
| community.okd | collection | 5.0.0 |
23+
| git-core | package | 2.47.3 |
24+
| gzip | package | 1.12 |
25+
| jmespath | pip | 1.0.1 |
26+
| jq | package | 1.6 |
27+
| kubernetes.core | collection | 6.1.0 |
28+
| kubernetes | pip | 34.1.0 |
29+
| make | package | 4.3 |
30+
| openshift | binary | 4.16.14 |
31+
| python3-pip | package | 21.3.1 |
32+
| python | package | 3.11.11 |
33+
| rhvp.cluster_utils | collection | 1.1.0 |
34+
| sshpass | package | 1.09 |
35+
36+
<!-- textlint-enable -->
3437

3538
## Usage
3639

@@ -68,14 +71,17 @@ podman run --rm -it --net=host \
6871
## Troubleshooting
6972

7073
**Permission issues with volume mounts**
74+
7175
- Ensure the `--security-opt label=disable` flag is used when running the container.
7276
- Check that your user has read/write access to the mounted directories.
7377

7478
**Network connectivity issues**
79+
7580
- Use `--net=host` for full network access.
7681
- For restricted environments, configure appropriate network policies.
7782

7883
**Missing tools or outdated versions**
84+
7985
- Check the installed software table above for current versions.
8086
- Consider building a custom image if you need different tool versions.
8187

0 commit comments

Comments
 (0)