Skip to content

Commit 42f4457

Browse files
ErcinDedeogluErcinDedeoglu
committed
'.'
1 parent 1516819 commit 42f4457

File tree

1 file changed

+148
-0
lines changed

1 file changed

+148
-0
lines changed

‎.github/workflows/docker-build-push.yml‎

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
# .github/workflows/docker-build-push.yml
2+
name: Reusable Docker Build and Push
3+
on:
4+
workflow_call:
5+
inputs:
6+
image_name:
7+
required: true
8+
type: string
9+
description: "Docker image name"
10+
platforms:
11+
required: false
12+
type: string
13+
default: 'linux/amd64,linux/arm64'
14+
description: "Platforms to build for"
15+
context_path:
16+
required: false
17+
type: string
18+
default: 'src'
19+
description: "Docker build context path"
20+
secrets:
21+
DOCKER_USERNAME:
22+
required: true
23+
description: "Docker Hub username"
24+
DOCKER_TOKEN:
25+
required: true
26+
description: "Docker Hub access token"
27+
28+
jobs:
29+
build-and-push:
30+
runs-on: ubuntu-latest
31+
permissions:
32+
contents: write
33+
packages: write
34+
steps:
35+
- name: Checkout repository
36+
uses: actions/checkout@v4
37+
38+
- name: Update version
39+
id: version
40+
env:
41+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
42+
run: |
43+
pip install requests
44+
chmod +x .github/workflows/build-push/update_version.py
45+
.github/workflows/build-push/update_version.py
46+
47+
- name: Set up QEMU
48+
uses: docker/setup-qemu-action@v3
49+
50+
- name: Set up Docker Buildx
51+
uses: docker/setup-buildx-action@v3
52+
53+
- name: Log in to Docker Hub
54+
uses: docker/login-action@v3
55+
with:
56+
username: ${{ secrets.DOCKER_USERNAME }}
57+
password: ${{ secrets.DOCKER_TOKEN }}
58+
59+
- name: Log in to GitHub Container Registry
60+
uses: docker/login-action@v3
61+
with:
62+
registry: ghcr.io
63+
username: ${{ github.actor }}
64+
password: ${{ secrets.GITHUB_TOKEN }}
65+
66+
- name: Generate Docker Tags
67+
id: meta
68+
run: |
69+
# Parse tags JSON into Docker format
70+
TAGS_JSON='${{ steps.version.outputs.tags }}'
71+
# Convert repository owner to lowercase
72+
REPO_OWNER=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
73+
# Generate Docker Hub tags
74+
DOCKERHUB_TAGS=$(echo "$TAGS_JSON" | jq -r '.[] | "${{ secrets.DOCKER_USERNAME }}/${{ inputs.image_name }}:" + .')
75+
# Generate GitHub Container Registry tags
76+
GHCR_TAGS=$(echo "$TAGS_JSON" | jq -r '.[] | "ghcr.io/'"${REPO_OWNER}"'/${{ inputs.image_name }}:" + .')
77+
# Combine all tags into a comma-separated list
78+
ALL_TAGS=$(echo -e "${DOCKERHUB_TAGS}\n${GHCR_TAGS}" | paste -sd "," -)
79+
# Set output
80+
echo "tags=${ALL_TAGS}" >> $GITHUB_OUTPUT
81+
82+
- name: Build and push Docker image
83+
uses: docker/build-push-action@v5
84+
with:
85+
context: ${{ inputs.context_path }}
86+
platforms: ${{ inputs.platforms }}
87+
push: ${{ github.event_name != 'pull_request' }}
88+
tags: ${{ steps.meta.outputs.tags }}
89+
labels: |
90+
org.opencontainers.image.title=${{ inputs.image_name }}
91+
org.opencontainers.image.version=${{ steps.version.outputs.full_version }}
92+
org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
93+
cache-from: type=gha
94+
cache-to: type=gha,mode=max
95+
96+
- name: Save Docker image
97+
run: |
98+
set -e # Exit on any error
99+
VERSION="${{ steps.version.outputs.full_version }}"
100+
101+
# Pull and save GitHub Container Registry image
102+
REPO_OWNER=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
103+
GHCR_TAG="ghcr.io/${REPO_OWNER}/${{ inputs.image_name }}:${VERSION}"
104+
echo "Pulling GitHub Container Registry image: $GHCR_TAG"
105+
docker pull $GHCR_TAG
106+
echo "Saving GitHub Container Registry image: $GHCR_TAG"
107+
docker save $GHCR_TAG -o "${{ inputs.image_name }}.tar"
108+
109+
- name: Generate SBOM
110+
env:
111+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
112+
FULL_VERSION: ${{ steps.version.outputs.full_version }}
113+
run: |
114+
chmod +x .github/workflows/build-push/generate_sbom.py
115+
.github/workflows/build-push/generate_sbom.py
116+
117+
- name: Generate Vulnerability Report
118+
env:
119+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
120+
FULL_VERSION: ${{ steps.version.outputs.full_version }}
121+
run: |
122+
chmod +x .github/workflows/build-push/generate_vulnerability_report.py
123+
.github/workflows/build-push/generate_vulnerability_report.py
124+
125+
- name: Create Release
126+
id: release
127+
env:
128+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
129+
run: |
130+
chmod +x .github/workflows/build-push/publish_release.py
131+
.github/workflows/build-push/publish_release.py
132+
133+
- name: Upload release assets
134+
env:
135+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
136+
run: |
137+
VERSION="${{ steps.version.outputs.full_version }}"
138+
BRANCH=${GITHUB_REF#refs/heads/}
139+
140+
# Copy files without dots to match release naming
141+
cp .vulnerability_report.txt vulnerability_report.txt
142+
143+
echo "Uploading release assets for version $VERSION"
144+
gh release upload "$VERSION" \
145+
"${{ inputs.image_name }}.tar" \
146+
".sbom/sbom.json" \
147+
".sbom/sbom.txt" \
148+
"vulnerability_report.txt"

0 commit comments

Comments
 (0)