Skip to content

Commit 99e8611

Browse files
alexirialexiri
committed
Start splitting it up
1 parent bed7825 commit 99e8611

File tree

3 files changed

+207
-106
lines changed

3 files changed

+207
-106
lines changed

‎.github/actions/build/action.yml‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
---
2+
name: Initial Build Action
3+
4+
inputs:
5+
platform:
6+
description: The platform to build the image for (e.g., "x86_64", "arm64")
7+
required: true
8+
variant:
9+
description: The variant of the image to build
10+
required: true
11+
containerfile:
12+
description: The path to the Containerfile used for building the image
13+
required: true
14+
image_name:
15+
description: The name of the image to build
16+
required: true
17+
image_path:
18+
description: The path where the image will be stored in the registry
19+
required: true
20+
image_tag:
21+
description: The tag for the image
22+
required: true
23+
skip_maximize_build_space:
24+
description: Whether to skip maximizing build space
25+
required: false
26+
REGISTRY:
27+
description: The container registry URL (e.g., "registry.example.com")
28+
required: true
29+
REGISTRY_USER:
30+
description: The username for the container registry login
31+
required: true
32+
REGISTRY_TOKEN:
33+
description: The token for authenticating with the container registry
34+
required: true
35+
36+
outputs:
37+
image-id:
38+
description: The ID of the built image
39+
value: ${{ steps.build.outputs.image-id }}
40+
date:
41+
description: The date when the image was built
42+
value: ${{ steps.build.outputs.date }}
43+
redhat-id:
44+
description: The Red Hat ID from the image labels
45+
value: ${{ steps.check.outputs.redhat-id }}
46+
redhat-version-id:
47+
description: The Red Hat version ID from the image labels
48+
value: ${{ steps.check.outputs.redhat-version-id }}
49+
version:
50+
description: The version of the image
51+
value: ${{ steps.check.outputs.version }}
52+
53+
runs:
54+
using: "composite"
55+
steps:
56+
- name: Set up environment
57+
id: set-env
58+
shell: bash
59+
run: |
60+
ARCH=${{ inputs.platform }}
61+
echo "CLEAN_ARCH=${ARCH//\//_}" >> "$GITHUB_ENV"
62+
63+
- name: Login to Container Registry
64+
shell: bash
65+
run: |
66+
# Docker login, not podman, because Cosign uses the docker login file
67+
echo ${{ inputs.REGISTRY_TOKEN }} | docker login -u ${{ inputs.REGISTRY_USER }} --password-stdin ${{ inputs.REGISTRY }}
68+
69+
- name: Maximize build space
70+
if: ${{ matrix.platform != 'arm64' && inputs.skip-maximize-build-space != true }}
71+
uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
72+
with:
73+
remove-codeql: true
74+
75+
- name: Build image
76+
id: build
77+
shell: bash
78+
env:
79+
IMAGE_TAG: ${{ inputs.image_tag }}-${{ env.CLEAN_ARCH }}
80+
run: |
81+
sudo podman build \
82+
--platform=linux/${{ inputs.platform }} \
83+
--security-opt=label=disable \
84+
--cap-add=all \
85+
--device /dev/fuse \
86+
--timestamp=0 \
87+
--iidfile /tmp/image-id \
88+
--build-arg IMAGE_NAME=${{ inputs.image_name }} \
89+
--build-arg IMAGE_REGISTRY=${{ inputs.REGISTRY }}/${{ inputs.image_path }} \
90+
--build-arg VARIANT=${{ inputs.variant }} \
91+
-t ${{ inputs.image_name }}:${IMAGE_TAG} \
92+
-f ${{ inputs.containerfile }} \
93+
.
94+
95+
echo "image-id=$(cat /tmp/image-id)" >> $GITHUB_OUTPUT
96+
echo "date=$(date -u +%Y\-%m\-%d\T%H\:%M\:%S\Z)" >> $GITHUB_OUTPUT
97+
98+
- name: Check image
99+
id: check
100+
shell: bash
101+
env:
102+
IMAGE_ID: ${{ steps.build.outputs.image-id }}
103+
run: |
104+
INSPECT=$(sudo podman image inspect ${{ env.IMAGE_ID }} )
105+
echo $INSPECT | jq .
106+
echo "redhat-id=$(echo "$INSPECT" | jq -r '.[0].Labels["redhat.id"]')" >> $GITHUB_OUTPUT
107+
echo "redhat-version-id=$(echo "$INSPECT" | jq -r '.[0].Labels["redhat.version-id"]')" >> $GITHUB_OUTPUT
108+
echo "version=$(echo "$INSPECT" | jq -r '.[0].Labels["org.opencontainers.image.version"]')" >> $GITHUB_OUTPUT
109+
110+
sudo podman run --platform=linux/${{ inputs.platform }} --rm ${{ env.IMAGE_ID }} bash -c "rpm -q almalinux-gpg-keys && cat /etc/os-release"

‎.github/actions/prepare-build/action.yml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
---
2+
name: Prepare Build
3+
description: |
4+
This action prepares the build environment by setting up the matrix for platforms,
5+
extracting the upstream image, and verifying its signature if provided.
6+
7+
inputs:
8+
platforms:
9+
description: Comma-separated list of platforms to build for (e.g., "amd64,arm64")
10+
required: true
11+
containerfile:
12+
description: Path to the Containerfile to use for extracting the upstream image
13+
required: true
14+
upstream-public-key:
15+
description: Public key for verifying the upstream image signature (optional)
16+
required: false
17+
18+
outputs:
19+
matrix:
20+
description: The matrix of platforms to build for
21+
value: ${{ steps.set-matrix.outputs.matrix }}
22+
tag:
23+
description: The working tag derived from the Git reference name
24+
value: ${{ steps.set-matrix.outputs.WORKING_TAG }}
25+
26+
runs:
27+
using: "composite"
28+
steps:
29+
- name: Set matrix
30+
id: set-matrix
31+
shell: bash
32+
run: |
33+
# turn the comma separated string into a list
34+
platforms=()
35+
IFS=',' read -r -a platforms <<< "${{ inputs.platforms }}"
36+
37+
MATRIX="{\"include\":[]}"
38+
for platform in "${platforms[@]}"; do
39+
MATRIX=$(echo $MATRIX | jq ".include += [{\"platform\": \"$platform\"}]")
40+
done
41+
echo "matrix=$(echo $MATRIX | jq -c '.')" >> $GITHUB_OUTPUT
42+
43+
WORKING_TAG="${{ github.ref_name }}"
44+
echo "WORKING_TAG=${WORKING_TAG//\//_}" >> "$GITHUB_OUTPUT"
45+
46+
- name: Install Cosign
47+
if: ${{ inputs.upstream-public-key != '' }}
48+
uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
49+
50+
- name: Checkout
51+
if: ${{ inputs.upstream-public-key != '' }}
52+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
53+
with:
54+
submodules: true
55+
56+
- name: Extract upstream
57+
if: ${{ inputs.upstream-public-key != '' }}
58+
id: extract
59+
shell: bash
60+
run: |
61+
# Install Dockerfile parser
62+
pip3 install dockerfile-parse
63+
# Extract the last FROM image using Python
64+
upstream=$(python3 - << 'EOF'
65+
from dockerfile_parse import DockerfileParser
66+
with open("${{ inputs.containerfile }}", "r") as f:
67+
dfp = DockerfileParser(fileobj=f)
68+
froms = [s['value'].split()[0] for s in dfp.structure if s['instruction'] == 'FROM']
69+
print(froms[-1])
70+
EOF
71+
)
72+
echo "upstream-image=$upstream" >> $GITHUB_OUTPUT
73+
74+
- name: Verify signature
75+
if: ${{ inputs.upstream-public-key != '' }}
76+
id: verify
77+
shell: bash
78+
run: |
79+
echo "Verifying signature for ${{ steps.extract.outputs.upstream-image }}"
80+
cosign verify --key ${{ inputs.upstream-public-key }} ${{ steps.extract.outputs.upstream-image }} | jq .

‎.github/workflows/build-image.yml‎

Lines changed: 17 additions & 106 deletions
Original file line numberDiff line numberDiff line change
@@ -118,55 +118,12 @@ jobs:
118118
matrix: ${{ steps.set-matrix.outputs.matrix }}
119119
tag: ${{ steps.set-matrix.outputs.WORKING_TAG }}
120120
steps:
121-
- name: Set matrix
121+
- uses: ./.github/actions/prepare-build
122122
id: set-matrix
123-
run: |
124-
# turn the comma separated string into a list
125-
platforms=()
126-
IFS=',' read -r -a platforms <<< "${{ inputs.platforms }}"
127-
128-
MATRIX="{\"include\":[]}"
129-
for platform in "${platforms[@]}"; do
130-
MATRIX=$(echo $MATRIX | jq ".include += [{\"platform\": \"$platform\"}]")
131-
done
132-
echo "matrix=$(echo $MATRIX | jq -c '.')" >> $GITHUB_OUTPUT
133-
134-
WORKING_TAG="${{ github.ref_name }}"
135-
echo "WORKING_TAG=${WORKING_TAG//\//_}" >> "$GITHUB_OUTPUT"
136-
137-
- name: Install Cosign
138-
if: ${{ inputs.upstream-public-key != '' }}
139-
uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
140-
141-
- name: Checkout
142-
if: ${{ inputs.upstream-public-key != '' }}
143-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
144123
with:
145-
submodules: true
146-
147-
- name: Extract upstream
148-
if: ${{ inputs.upstream-public-key != '' }}
149-
id: extract
150-
run: |
151-
# Install Dockerfile parser
152-
pip3 install dockerfile-parse
153-
# Extract the last FROM image using Python
154-
upstream=$(python3 - << 'EOF'
155-
from dockerfile_parse import DockerfileParser
156-
with open("${{ inputs.containerfile }}", "r") as f:
157-
dfp = DockerfileParser(fileobj=f)
158-
froms = [s['value'].split()[0] for s in dfp.structure if s['instruction'] == 'FROM']
159-
print(froms[-1])
160-
EOF
161-
)
162-
echo "upstream-image=$upstream" >> $GITHUB_OUTPUT
163-
164-
- name: Verify signature
165-
if: ${{ inputs.upstream-public-key != '' }}
166-
id: verify
167-
run: |
168-
echo "Verifying signature for ${{ steps.extract.outputs.upstream-image }}"
169-
cosign verify --key ${{ inputs.upstream-public-key }} ${{ steps.extract.outputs.upstream-image }} | jq .
124+
platforms: ${{ inputs.platforms }}
125+
containerfile: ${{ inputs.containerfile }}
126+
upstream-public-key: ${{ inputs.upstream-public-key }}
170127

171128
build_push:
172129
name: Build and push image
@@ -189,68 +146,22 @@ jobs:
189146
version: ${{ steps.load.outputs.version }}
190147

191148
steps:
192-
- name: Set up environment
193-
id: set-env
194-
run: |
195-
ARCH=${{ matrix.platform }}
196-
echo "CLEAN_ARCH=${ARCH//\//_}" >> "$GITHUB_ENV"
197-
198-
- name: Login to Container Registry
199-
run: |
200-
echo ${{ secrets.REGISTRY_TOKEN }} | podman login -u ${{ inputs.REGISTRY_USER }} --password-stdin ${{ env.IMAGE_REGISTRY }}
201-
202-
# This is needed by cosign
203-
echo ${{ secrets.REGISTRY_TOKEN }} | docker login -u ${{ inputs.REGISTRY_USER }} --password-stdin ${{ env.IMAGE_REGISTRY }}
204-
205-
- name: Maximize build space
206-
if: ${{ matrix.platform != 'arm64' && inputs.skip-maximize-build-space != true }}
207-
uses: ublue-os/remove-unwanted-software@cc0becac701cf642c8f0a6613bbdaf5dc36b259e # v9
208-
with:
209-
remove-codeql: true
210-
211149
- name: Checkout
212150
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
213-
with:
214-
submodules: true
215-
fetch-depth: 500
216-
217-
- name: Build image
218-
id: build
219-
shell: bash
220-
env:
221-
IMAGE_TAG: ${{ needs.generate_matrix.outputs.tag }}-${{ env.CLEAN_ARCH }}
222-
VARIANT: ${{ inputs.variant }}
223-
run: |
224-
sudo podman build \
225-
--platform=linux/${{ matrix.platform }} \
226-
--security-opt=label=disable \
227-
--cap-add=all \
228-
--device /dev/fuse \
229-
--timestamp=0 \
230-
--iidfile /tmp/image-id \
231-
--build-arg IMAGE_NAME=${{ env.IMAGE_NAME }} \
232-
--build-arg IMAGE_REGISTRY=${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_PATH }} \
233-
--build-arg VARIANT=${{ env.VARIANT }} \
234-
-t ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} \
235-
-f ${{ env.CONTAINERFILE }} \
236-
.
237-
238-
echo "image-id=$(cat /tmp/image-id)" >> $GITHUB_OUTPUT
239-
echo "date=$(date -u +%Y\-%m\-%d\T%H\:%M\:%S\Z)" >> $GITHUB_OUTPUT
240151

241-
- name: Check image
242-
id: check
243-
shell: bash
244-
env:
245-
IMAGE_ID: ${{ steps.build.outputs.image-id }}
246-
run: |
247-
INSPECT=$(sudo podman image inspect ${{ env.IMAGE_ID }} )
248-
echo $INSPECT | jq .
249-
echo "redhat-id=$(echo "$INSPECT" | jq -r '.[0].Labels["redhat.id"]')" >> $GITHUB_OUTPUT
250-
echo "redhat-version-id=$(echo "$INSPECT" | jq -r '.[0].Labels["redhat.version-id"]')" >> $GITHUB_OUTPUT
251-
echo "version=$(echo "$INSPECT" | jq -r '.[0].Labels["org.opencontainers.image.version"]')" >> $GITHUB_OUTPUT
252-
253-
sudo podman run --platform=linux/${{ matrix.platform }} --rm ${{ env.IMAGE_ID }} bash -c "rpm -q almalinux-gpg-keys && cat /etc/os-release"
152+
- uses: ./.github/actions/build
153+
id: initial-build
154+
with:
155+
platforms: ${{ matrix.platform }}
156+
variant: ${{ inputs.variant }}
157+
containerfile: ${{ inputs.containerfile }}
158+
image_name: ${{ inputs.image-name }}
159+
image_path: ${{ inputs.image-path }}
160+
image_tag: ${{ needs.generate_matrix.outputs.tag }}
161+
skip_maximize_build_space: ${{ inputs.skip-maximize-build-space }}
162+
REGISTRY: ${{ inputs.REGISTRY }}
163+
REGISTRY_USER: ${{ inputs.REGISTRY_USER }}
164+
REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
254165

255166
- name: Setup Syft
256167
id: setup-syft

0 commit comments

Comments
 (0)