Skip to content

Commit 5a398d0

Browse files
evansimsevansims
committed
ci: use native runners
1 parent 737513c commit 5a398d0

File tree

1 file changed

+256
-0
lines changed

1 file changed

+256
-0
lines changed

‎.github/workflows/container.yml‎

Lines changed: 256 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,256 @@
1+
# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
2+
3+
name: Container
4+
5+
on:
6+
push:
7+
branches:
8+
- main
9+
tags:
10+
- "v*.*.*"
11+
paths:
12+
- "crates/**"
13+
- "Cargo.toml"
14+
- "Cargo.lock"
15+
- "Dockerfile"
16+
- ".github/workflows/container.yml"
17+
pull_request:
18+
branches:
19+
- main
20+
paths:
21+
- "Dockerfile"
22+
- ".github/workflows/container.yml"
23+
workflow_dispatch:
24+
25+
permissions:
26+
contents: read
27+
packages: write
28+
29+
env:
30+
REGISTRY: ghcr.io
31+
IMAGE_NAME: inferadb/control
32+
33+
jobs:
34+
# Build each platform on native runners for fast compilation
35+
build:
36+
name: Build (${{ matrix.platform }})
37+
strategy:
38+
fail-fast: false
39+
matrix:
40+
include:
41+
- platform: linux/amd64
42+
runner: ubuntu-latest
43+
suffix: amd64
44+
- platform: linux/arm64
45+
runner: ubuntu-24.04-arm
46+
suffix: arm64
47+
runs-on: ${{ matrix.runner }}
48+
outputs:
49+
# Pass metadata to merge job
50+
tags: ${{ steps.meta.outputs.tags }}
51+
labels: ${{ steps.meta.outputs.labels }}
52+
version: ${{ steps.meta.outputs.version }}
53+
steps:
54+
- name: Harden the runner (Audit all outbound calls)
55+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
56+
with:
57+
egress-policy: audit
58+
59+
- name: Checkout code
60+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
61+
62+
- name: Set up Docker Buildx
63+
uses: step-security/setup-buildx-action@8c8aef2d414c0b66518fee2b7084e0986f82d7ac # v3.11.1
64+
65+
- name: Log in to GitHub Container Registry
66+
if: github.event_name != 'pull_request'
67+
uses: step-security/docker-login-action@c3e677aae8393bc9c81cfdf9709648720ea4bd4d # v3.6.0
68+
with:
69+
registry: ${{ env.REGISTRY }}
70+
username: ${{ github.actor }}
71+
password: ${{ secrets.GITHUB_TOKEN }}
72+
73+
- name: Extract metadata
74+
id: meta
75+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
76+
with:
77+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
78+
tags: |
79+
# Branch name (main)
80+
type=ref,event=branch
81+
# Tag name (v1.0.0)
82+
type=ref,event=tag
83+
# Semantic versioning
84+
type=semver,pattern={{version}}
85+
type=semver,pattern={{major}}.{{minor}}
86+
type=semver,pattern={{major}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.') }}
87+
# SHA for PRs and commits
88+
type=sha,prefix=sha-
89+
# Latest tag for releases
90+
type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-') }}
91+
92+
- name: Build and push by digest
93+
id: build
94+
uses: step-security/docker-build-push-action@a8c3d08b23f8be6aeed43eb1a14ce6fe51284438 # v6.18.0
95+
with:
96+
context: .
97+
platforms: ${{ matrix.platform }}
98+
labels: ${{ steps.meta.outputs.labels }}
99+
outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }}
100+
cache-from: type=gha,scope=build-${{ matrix.suffix }}
101+
cache-to: type=gha,mode=max,scope=build-${{ matrix.suffix }}
102+
103+
- name: Export digest
104+
if: github.event_name != 'pull_request'
105+
run: |
106+
mkdir -p /tmp/digests
107+
digest="${{ steps.build.outputs.digest }}"
108+
touch "/tmp/digests/${digest#sha256:}"
109+
110+
- name: Upload digest
111+
if: github.event_name != 'pull_request'
112+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
113+
with:
114+
name: digests-${{ matrix.suffix }}
115+
path: /tmp/digests/*
116+
if-no-files-found: error
117+
retention-days: 1
118+
119+
# Merge platform-specific images into multi-arch manifest
120+
merge:
121+
name: Create Multi-Arch Manifest
122+
runs-on: ubuntu-latest
123+
needs: build
124+
if: github.event_name != 'pull_request'
125+
steps:
126+
- name: Harden the runner (Audit all outbound calls)
127+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
128+
with:
129+
egress-policy: audit
130+
131+
- name: Download digests
132+
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
133+
with:
134+
path: /tmp/digests
135+
pattern: digests-*
136+
merge-multiple: true
137+
138+
- name: Set up Docker Buildx
139+
uses: step-security/setup-buildx-action@8c8aef2d414c0b66518fee2b7084e0986f82d7ac # v3.11.1
140+
141+
- name: Log in to GitHub Container Registry
142+
uses: step-security/docker-login-action@c3e677aae8393bc9c81cfdf9709648720ea4bd4d # v3.6.0
143+
with:
144+
registry: ${{ env.REGISTRY }}
145+
username: ${{ github.actor }}
146+
password: ${{ secrets.GITHUB_TOKEN }}
147+
148+
- name: Extract metadata
149+
id: meta
150+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
151+
with:
152+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
153+
tags: |
154+
# Branch name (main)
155+
type=ref,event=branch
156+
# Tag name (v1.0.0)
157+
type=ref,event=tag
158+
# Semantic versioning
159+
type=semver,pattern={{version}}
160+
type=semver,pattern={{major}}.{{minor}}
161+
type=semver,pattern={{major}},enable=${{ !startsWith(github.ref, 'refs/tags/v0.') }}
162+
# SHA for PRs and commits
163+
type=sha,prefix=sha-
164+
# Latest tag for releases
165+
type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-') }}
166+
167+
- name: Create manifest list and push
168+
working-directory: /tmp/digests
169+
run: |
170+
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
171+
$(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)
172+
173+
- name: Inspect image
174+
run: |
175+
docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
176+
177+
# Generate SBOM after manifest is created
178+
sbom:
179+
name: Generate SBOM
180+
runs-on: ubuntu-latest
181+
needs: merge
182+
if: github.event_name != 'pull_request'
183+
steps:
184+
- name: Harden the runner (Audit all outbound calls)
185+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
186+
with:
187+
egress-policy: audit
188+
189+
- name: Log in to GitHub Container Registry
190+
uses: step-security/docker-login-action@c3e677aae8393bc9c81cfdf9709648720ea4bd4d # v3.6.0
191+
with:
192+
registry: ${{ env.REGISTRY }}
193+
username: ${{ github.actor }}
194+
password: ${{ secrets.GITHUB_TOKEN }}
195+
196+
- name: Extract metadata
197+
id: meta
198+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
199+
with:
200+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
201+
tags: |
202+
type=sha,prefix=sha-
203+
204+
- name: Generate SBOM
205+
uses: anchore/sbom-action@e11c554f704a0b820cbf8c51673f6945e0731532 # v0.20.0
206+
with:
207+
image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
208+
artifact-name: sbom.spdx.json
209+
output-file: sbom.spdx.json
210+
211+
- name: Upload SBOM
212+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
213+
with:
214+
name: sbom
215+
path: sbom.spdx.json
216+
retention-days: 90
217+
218+
# Scan container for vulnerabilities
219+
scan:
220+
name: Scan Container
221+
needs: merge
222+
runs-on: ubuntu-latest
223+
if: github.event_name != 'pull_request'
224+
steps:
225+
- name: Harden the runner (Audit all outbound calls)
226+
uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
227+
with:
228+
egress-policy: audit
229+
230+
- name: Log in to GitHub Container Registry
231+
uses: step-security/docker-login-action@c3e677aae8393bc9c81cfdf9709648720ea4bd4d # v3.6.0
232+
with:
233+
registry: ${{ env.REGISTRY }}
234+
username: ${{ github.actor }}
235+
password: ${{ secrets.GITHUB_TOKEN }}
236+
237+
- name: Extract metadata
238+
id: meta
239+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
240+
with:
241+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
242+
tags: |
243+
type=sha,prefix=sha-
244+
245+
- name: Run Trivy vulnerability scanner
246+
uses: aquasecurity/trivy-action@76071ef0d7ec797419534a183b498b4d6366cf37 # 0.31.0
247+
with:
248+
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
249+
format: "sarif"
250+
output: "trivy-results.sarif"
251+
severity: "CRITICAL,HIGH"
252+
253+
- name: Upload Trivy scan results
254+
uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
255+
with:
256+
sarif_file: "trivy-results.sarif"

0 commit comments

Comments
 (0)