Skip to content

Commit 25a8c0f

Browse files
ixxeL2097Frederic Spiers
ixxeL2097
and
Frederic Spiers
authored
feat(valkey): add Valkey image with GH workflow (#20)
Co-authored-by: Frederic Spiers <[email protected]>
1 parent f7847cf commit 25a8c0f

File tree

9 files changed

+213
-0
lines changed

9 files changed

+213
-0
lines changed

‎.github/workflows/valkey.yaml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: valkey
2+
3+
on:
4+
schedule:
5+
- cron: "00 01 * * 1-5"
6+
pull_request:
7+
paths:
8+
- .github/workflows/valkey.yaml
9+
- 'images/valkey/*.yaml'
10+
- 'images/valkey/**/*.yaml'
11+
push:
12+
branches:
13+
- 'main'
14+
paths:
15+
- .github/workflows/valkey.yaml
16+
- 'images/valkey/*.yaml'
17+
- 'images/valkey/**/*.yaml'
18+
workflow_dispatch:
19+
20+
permissions:
21+
contents: read
22+
packages: write
23+
attestations: write
24+
id-token: write
25+
security-events: write
26+
actions: read
27+
28+
jobs:
29+
publish:
30+
strategy:
31+
matrix:
32+
version: [latest, "8.1"]
33+
variant: [prod, dev]
34+
name: ${{ matrix.version }}${{ matrix.variant == 'shell' && '-shell' || matrix.variant == 'dev' && '-dev' || '' }}
35+
uses: './.github/workflows/release.yaml'
36+
with:
37+
tag: ${{ matrix.version }}${{ matrix.variant == 'shell' && '-shell' || matrix.variant == 'dev' && '-dev' || '' }}
38+
target: ${{ format('{0}/{1}', matrix.version, matrix.variant) }}
39+
secrets: inherit

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,3 +40,4 @@
4040
| [redis-bitnami](./images/redis-bitnami/) | `docker pull ghcr.io/gitguardian/wolfi/redis-bitnami` |
4141
| [shell](./images/shell/) | `docker pull ghcr.io/gitguardian/wolfi/shell` |
4242
| [traefik](./images/traefik/) | `docker pull ghcr.io/gitguardian/wolfi/traefik` |
43+
| [valkey](./images/valkey/) | `docker pull ghcr.io/gitguardian/wolfi/valkey` |

‎images/valkey/8.1/dev.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
include: images/valkey/dev.yaml
2+
3+
contents:
4+
packages:
5+
- valkey-8.1
6+
- valkey-8.1-cli

‎images/valkey/8.1/prod.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
include: images/valkey/prod.yaml
2+
3+
contents:
4+
packages:
5+
- valkey-8.1
6+
- valkey-8.1-cli

‎images/valkey/README.md‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
# Valkey
2+
3+
Minimal Python image based on Wolfi.
4+
5+
## Versions
6+
7+
| 📌 Version | ⬇️ Pull URL |
8+
| ---------- | --------------------------------------------- |
9+
| latest | ghcr.io/gitguardian/wolfi/valkey:latest |
10+
| latest-dev | ghcr.io/gitguardian/wolfi/valkey:latest-dev |
11+
| 8.1 | ghcr.io/gitguardian/wolfi/valkey:8.1 |
12+
| 8.1-dev | ghcr.io/gitguardian/wolfi/valkey:8.1-dev |
13+
14+
15+
## ✅ Verify the Provenance
16+
17+
```shell
18+
gh attestation verify \
19+
--owner gitguardian \
20+
oci://ghcr.io/gitguardian/wolfi/valkey:latest
21+
```
22+
23+
- **Shell image**
24+
25+
```shell
26+
gh attestation verify \
27+
--owner gitguardian \
28+
oci://ghcr.io/gitguardian/wolfi/valkey:latest-shell
29+
```
30+
31+
## 📦 **Image Verification**
32+
cosign verify \
33+
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
34+
--certificate-identity=https://github.com/GitGuardian/wolfi/.github/workflows/release.yaml@refs/heads/main \
35+
ghcr.io/gitguardian/wolfi/valkey:latest | jq
36+
```
37+
38+
- **Shell image**
39+
cosign verify \
40+
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
41+
--certificate-identity=https://github.com/GitGuardian/wolfi/.github/workflows/release.yaml@refs/heads/main \
42+
ghcr.io/gitguardian/wolfi/valkey:latest-shell | jq
43+
```
44+
45+
### 📦 **Image SBOMs**
46+
--type=https://spdx.dev/Document \
47+
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
48+
--certificate-identity=https://github.com/GitGuardian/wolfi/.github/workflows/release.yaml@refs/heads/main \
49+
ghcr.io/gitguardian/wolfi/valkey:latest
50+
```
51+
52+
- **Shell image**
53+
--type=https://spdx.dev/Document \
54+
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
55+
--certificate-identity=https://github.com/GitGuardian/wolfi/.github/workflows/release.yaml@refs/heads/main \
56+
ghcr.io/gitguardian/wolfi/valkey:latest-shell
57+
```
58+
59+
This will pull in the signature for the attestation specified by the --type parameter, which in this case is the SPDX attestation. You will receive output that verifies the SBOM attestation signature in cosign's transparency log:
60+
61+
```shell
62+
Verification for ghcr.io/gitguardian/wolfi/valkey:latest --
63+
The following checks were performed on each of these signatures:
64+
- The cosign claims were validated
65+
- Existence of the claims in the transparency log was verified offline
66+
Certificate issuer URL: https://token.actions.githubusercontent.com
67+
GitHub Workflow Trigger: push
68+
GitHub Workflow SHA: ced6b3cfab1341509de55bff7c0389ce81f73aae
69+
GitHub Workflow Name: valkey
70+
GitHub Workflow Repository: GitGuardian/wolfi
71+
GitHub Workflow Ref: refs/heads/main
72+
...
73+
```
74+
75+
#### ✅ Download the Image SBOM Attestations
76+
77+
To download an attestation, use the `cosign` download attestation command and provide both the predicate type and the build platform. For example, the following command will obtain the SBOM for the valkey image on `linux/amd64`:
78+
79+
- **Production image**
80+
81+
```shell
82+
cosign download attestation \
83+
--platform=linux/amd64 \
84+
--predicate-type=https://spdx.dev/Document \
85+
ghcr.io/gitguardian/wolfi/valkey:latest | jq -r .payload | base64 -d | jq .predicate
86+
```
87+
88+
- **Shell image**
89+
cosign download attestation \
90+
--platform=linux/amd64 \
91+
--predicate-type=https://spdx.dev/Document \
92+
ghcr.io/gitguardian/wolfi/valkey:latest-shell | jq -r .payload | base64 -d | jq .predicate
93+
```

‎images/valkey/dev.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
include: images/valkey/prod.yaml
2+
3+
contents:
4+
packages:
5+
- apk-tools
6+
- build-base
7+
- git
8+
- vim
9+
- wolfi-keys
10+
11+
accounts:
12+
run-as: root

‎images/valkey/latest/dev.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
include: images/valkey/8.1/dev.yaml

‎images/valkey/latest/prod.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
include: images/valkey/8.1/prod.yaml

‎images/valkey/prod.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
include: images/apko.yaml
2+
3+
contents:
4+
packages:
5+
- bash
6+
- busybox
7+
- ca-certificates-bundle
8+
- gosu
9+
- curl
10+
- wolfi-baselayout
11+
12+
accounts:
13+
groups:
14+
- groupname: valkey
15+
gid: 999
16+
users:
17+
- username: valkey
18+
uid: 999
19+
gid: 999
20+
run-as: valkey
21+
22+
paths:
23+
- path: /var/lib/valkey
24+
type: directory
25+
permissions: 0o755
26+
uid: 999
27+
gid: 999
28+
- path: /var/lib/valkey/data
29+
type: directory
30+
permissions: 0o755
31+
uid: 999
32+
gid: 999
33+
- path: /etc/valkey
34+
type: directory
35+
permissions: 0o755
36+
uid: 999
37+
gid: 999
38+
- path: /var/log/valkey
39+
type: directory
40+
permissions: 0o755
41+
uid: 999
42+
gid: 999
43+
44+
work-dir: /var/lib/valkey
45+
46+
entrypoint:
47+
command: /usr/bin/docker-entrypoint.sh
48+
49+
cmd: valkey-server /etc/valkey/valkey.conf
50+
51+
annotations:
52+
org.opencontainers.image.title: 'Valkey'
53+
org.opencontainers.image.description: 'Valkey image based on Wolfi OS'
54+
org.opencontainers.image.source: 'https://github.com/GitGuardian/wolfi/tree/main/images/valkey'

0 commit comments

Comments
 (0)