-
Notifications
You must be signed in to change notification settings - Fork 0
150 lines (130 loc) · 5.18 KB
/
docker.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
name: Build Docker images
on:
push:
tags:
- "v*"
permissions:
contents: read
jobs:
docker-cm:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
outputs:
digest: ${{ steps.build.outputs.digest }}
steps:
- name: Checkout the repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
- name: Login to Docker Hub
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Extract metadata (tags, labels) for Docker
id: meta
uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
with:
images: ctferio/chall-manager
- name: Git commit date
id: infos
run: |
# trim version prefix
version=${{ github.ref_name }}
version="${version#"v"}"
echo "version=$version" >> "$GITHUB_OUTPUT"
# output date per RFC 3339
date="$(git log -1 --format=%cd --date=format:%Y-%m-%dT%H:%M:%SZ)"
echo "date=$date" >> "$GITHUB_OUTPUT"
- name: Build and push Docker image
uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
id: build
with:
push: true
sbom: true # may not produce SBOM in manifest if the image has no filesystem (e.g. "FROM scratch")
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
file: Dockerfile.chall-manager
build-args: |
VERSION=${{ steps.infos.outputs.version }}
COMMIT=${{ github.sha }}
DATE=${{ steps.infos.outputs.date }}
# This step calls the container workflow to generate provenance and push it to
# the container registry.
provenance-cm:
needs: [docker-cm]
permissions:
actions: read # for detecting the Github Actions environment.
id-token: write # for creating OIDC tokens for signing.
packages: write # for uploading attestations.
if: startsWith(github.ref, 'refs/tags/')
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
with:
image: ctferio/chall-manager
digest: ${{ needs.docker-cm.outputs.digest }}
secrets:
registry-username: ${{ secrets.DOCKERHUB_USERNAME }}
registry-password: ${{ secrets.DOCKERHUB_TOKEN }}
docker-cmj:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
outputs:
digest: ${{ steps.build.outputs.digest }}
steps:
- name: Checkout the repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
- name: Login to Docker Hub
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Extract metadata (tags, labels) for Docker
id: meta
uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
with:
images: ctferio/chall-manager-janitor
- name: Git commit date
id: infos
run: |
# trim version prefix
version=${{ github.ref_name }}
version="${version#"v"}"
echo "version=$version" >> "$GITHUB_OUTPUT"
# output date per RFC 3339
date="$(git log -1 --format=%cd --date=format:%Y-%m-%dT%H:%M:%SZ)"
echo "date=$date" >> "$GITHUB_OUTPUT"
- name: Build and push Docker image
uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
id: build
with:
push: true
sbom: true # may not produce SBOM in manifest if the image has no filesystem (e.g. "FROM scratch")
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
file: Dockerfile.chall-manager-janitor
build-args: |
VERSION=${{ steps.infos.outputs.version }}
COMMIT=${{ github.sha }}
DATE=${{ steps.infos.outputs.date }}
# This step calls the container workflow to generate provenance and push it to
# the container registry.
provenance-cmj:
needs: [docker-cmj]
permissions:
actions: read # for detecting the Github Actions environment.
id-token: write # for creating OIDC tokens for signing.
packages: write # for uploading attestations.
if: startsWith(github.ref, 'refs/tags/')
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
with:
image: ctferio/chall-manager-janitor
digest: ${{ needs.docker-cmj.outputs.digest }}
secrets:
registry-username: ${{ secrets.DOCKERHUB_USERNAME }}
registry-password: ${{ secrets.DOCKERHUB_TOKEN }}