chore: adds a cloudbuild file #630 (#634)

Dockerfile

@@ -20,6 +20,7 @@ ARG COMMIT
 ADD ./internal /go/src/apigeecli/internal
 ADD ./cmd /go/src/apigeecli/cmd
 
+COPY .github/workflows/licenses.tpl /go/src/apigeecli
 COPY go.mod go.sum /go/src/apigeecli/
 
 WORKDIR /go/src/apigeecli
@@ -28,6 +29,8 @@ ENV GO111MODULE=on
 RUN go mod tidy
 RUN go mod download
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -buildvcs=true -a -gcflags='all="-l"' -ldflags='-s -w -extldflags "-static" -X main.version='${TAG}' -X main.commit='${COMMIT}' -X main.date='$(date +%FT%H:%I:%M+%Z) -o /go/bin/apigeecli /go/src/apigeecli/cmd/apigeecli/apigeecli.go
+RUN GOBIN=/tmp/ go install github.com/google/[email protected]
+RUN /tmp/go-licenses report ./... --template /go/src/apigeecli/licenses.tpl --ignore internal > /tmp/third-party-licenses.txt 2> /dev/null || echo "Ignore warnings"
 
 FROM ghcr.io/jqlang/jq:1.7.1@sha256:096b83865ad59b5b02841f103f83f45c51318394331bf1995e187ea3be937432 AS jq
 
@@ -41,8 +44,8 @@ LABEL org.opencontainers.image.url='https://github.com/apigee/apigeecli' \
       org.opencontainers.image.description='This is a tool to interact with Apigee APIs'
 
 COPY --from=builder /go/bin/apigeecli /usr/local/bin/apigeecli
-COPY LICENSE.txt /
-COPY third-party-licenses.txt /
+COPY --chown=nonroot:nonroot LICENSE.txt /
+COPY --from=builder --chown=nonroot:nonroot /tmp/third-party-licenses.txt /
 COPY --from=jq /jq /usr/local/bin/jq
 
 ENTRYPOINT [ "apigeecli" ]

cloudbuild.yaml

@@ -0,0 +1,96 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# gcloud builds submit --config=cloudbuild.yaml --project=project-name --substitutions=TAG="v0.65"
+steps:
+#publish latest cosign
+- name: 'gcr.io/cloud-builders/docker'
+  id: build_cosign
+  args:
+    - 'build'
+    - '-t'
+    - '${_COSIGN_IMAGE_NAME}:latest'
+    - '-f'
+    - 'Dockerfile.cosign'
+    - '.'
+- name: 'gcr.io/cloud-builders/docker'
+  id: push_cosign
+  args: ['push', '${_COSIGN_IMAGE_NAME}:latest']
+#publish apigeecli
+- name: 'gcr.io/cloud-builders/docker'
+  id: build_apigeecli
+  args:
+    - 'build'
+    - '-t'
+    - '${_IMAGE_NAME}:${TAG_NAME}'
+    - '-f'
+    - 'Dockerfile'
+    - '.'
+    - '--build-arg'
+    - 'TAG=${TAG_NAME}'
+    - '--build-arg'
+    - 'COMMIT=$COMMIT_SHA'
+- name: 'gcr.io/cloud-builders/docker'
+  id: push_apigeecli
+  args: ['push', '${_IMAGE_NAME}:${TAG_NAME}']
+- name: 'gcr.io/cloud-builders/docker'
+  id: tag_latest_apigeecli
+  args: ['tag', '${_IMAGE_NAME}:${TAG_NAME}', '${_IMAGE_NAME}:latest']
+- name: 'gcr.io/cloud-builders/docker'
+  id: push_latest_apigeecli
+  args: ['push', '${_IMAGE_NAME}:latest']
+
+#sign and attach apigeecli
+- name: 'us-docker.pkg.dev/${PROJECT_ID}/${_REPO}/cosign:latest'
+  id: sign_apigeecli
+  entrypoint: 'sh'
+  secretEnv: ['COSIGN_PASSWORD', 'COSIGN_PRIVATE_KEY']
+  args:
+    - -c
+    - |
+      echo "$$COSIGN_PRIVATE_KEY" > /tmp/cosign.key
+      cosign sign --key=/tmp/cosign.key --output-signature=/tmp/apigeecli_${TAG_NAME}.sig --yes ${_IMAGE_NAME}:${TAG_NAME}
+      cosign attach signature --signature=/tmp/apigeecli_${TAG_NAME}.sig ${_IMAGE_NAME}:${TAG_NAME}
+
+- name: "gcr.io/google.com/cloudsdktool/cloud-sdk"
+  id: export_sbom
+  entrypoint: gcloud
+  args:
+    - artifacts
+    - sbom
+    - export
+    - --uri=${_IMAGE_NAME}:${TAG_NAME}
+    - --project=${PROJECT_ID}
+
+availableSecrets:
+  secretManager:
+  - versionName: projects/$PROJECT_ID/secrets/apigeecli-cosign-password/versions/latest
+    env: 'COSIGN_PASSWORD'
+  - versionName: projects/$PROJECT_ID/secrets/apigeecli-cosign-private-key/versions/latest
+    env: 'COSIGN_PRIVATE_KEY'
+
+images:
+- '${_IMAGE_NAME}:${TAG_NAME}'
+
+#repo name
+substitutions:
+  _REPO: "images"
+  _IMAGE_NAME: "us-docker.pkg.dev/${PROJECT_ID}/${_REPO}/apigeecli"
+  _COSIGN_IMAGE_NAME: "us-docker.pkg.dev/${PROJECT_ID}/${_REPO}/cosign"
+
+options:
+  machineType: E2_HIGHCPU_8
+  logging: CLOUD_LOGGING_ONLY
+  substitution_option: ALLOW_LOOSE
+  dynamic_substitutions: true
+  requestedVerifyOption: VERIFIED