Skip to content

Commit 4299bd3

Browse files
hangyhangy
committed
ci: Build OTEL enabled container image
1 parent 4867955 commit 4299bd3

File tree

4 files changed

+458
-1
lines changed

4 files changed

+458
-1
lines changed

‎.github/workflows/alpine-mainline.yml‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -383,3 +383,121 @@ jobs:
383383
DOCKER_CONTENT_TRUST_REPOSITORY_KEY_ID: ${{ secrets.DOCKER_CONTENT_TRUST_REPOSITORY_KEY_ID }}
384384
DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: ${{ secrets.DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE }}
385385
NOTARY_TARGETS_PASSPHRASE: ${{ secrets.DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE }}
386+
387+
otel:
388+
name: Build Alpine NGINX mainline otel Docker image
389+
needs: [version, core]
390+
runs-on: ubuntu-24.04
391+
strategy:
392+
fail-fast: false
393+
steps:
394+
- name: Check out the codebase
395+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
396+
397+
- name: Set up QEMU
398+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
399+
400+
- name: Set up Docker Buildx
401+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
402+
403+
- name: Configure AWS credentials
404+
if: ${{ github.event_name != 'pull_request' }}
405+
uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
406+
with:
407+
aws-region: ${{ secrets.AWS_REGION }}
408+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
409+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
410+
411+
- name: Login to Amazon ECR Public Gallery
412+
if: ${{ github.event_name != 'pull_request' }}
413+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
414+
with:
415+
registry: public.ecr.aws
416+
417+
- name: Login to Docker Hub
418+
if: ${{ github.event_name != 'pull_request' }}
419+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
420+
with:
421+
username: ${{ secrets.DOCKERHUB_USERNAME }}
422+
password: ${{ secrets.DOCKERHUB_TOKEN }}
423+
424+
- name: Login to GitHub Container Registry
425+
if: ${{ github.event_name != 'pull_request' }}
426+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
427+
with:
428+
registry: ghcr.io
429+
username: ${{ github.actor }}
430+
password: ${{ secrets.GITHUB_TOKEN }}
431+
432+
- name: Login to Quay
433+
if: ${{ github.event_name != 'pull_request' }}
434+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
435+
with:
436+
registry: quay.io
437+
username: ${{ secrets.QUAY_USERNAME }}
438+
password: ${{ secrets.QUAY_TOKEN }}
439+
440+
- name: Extract metadata (annotations, labels, tags) for Docker
441+
id: meta
442+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
443+
with:
444+
images: |
445+
docker.io/nginxinc/nginx-unprivileged
446+
ghcr.io/nginx/nginx-unprivileged
447+
public.ecr.aws/nginx/nginx-unprivileged
448+
quay.io/nginx/nginx-unprivileged
449+
tags: |
450+
type=raw,value=${{ needs.version.outputs.major }}.${{ needs.version.outputs.minor }}.${{ needs.version.outputs.patch }}-alpine-otel
451+
type=raw,value=${{ needs.version.outputs.major }}.${{ needs.version.outputs.minor }}.${{ needs.version.outputs.patch }}-alpine${{ needs.version.outputs.distro }}-otel
452+
type=raw,value=${{ needs.version.outputs.major }}.${{ needs.version.outputs.minor }}-alpine-otel
453+
type=raw,value=${{ needs.version.outputs.major }}.${{ needs.version.outputs.minor }}-alpine${{ needs.version.outputs.distro }}-otel
454+
type=raw,value=${{ needs.version.outputs.major }}-alpine-otel
455+
type=raw,value=${{ needs.version.outputs.major }}-alpine${{ needs.version.outputs.distro }}-otel
456+
type=raw,value=mainline-alpine-otel
457+
type=raw,value=mainline-alpine${{ needs.version.outputs.distro }}-otel
458+
type=raw,value=alpine-otel
459+
type=raw,value=alpine${{ needs.version.outputs.distro }}-otel
460+
env:
461+
DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
462+
463+
- name: Build and push NGINX mainline otel Alpine image to Amazon ECR Public Gallery, Docker Hub, GitHub Container Registry, and Quay
464+
id: build
465+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
466+
with:
467+
platforms: linux/amd64, linux/arm/v6, linux/arm/v7, linux/arm64, linux/386, linux/ppc64le, linux/riscv64, linux/s390x
468+
context: "{{ defaultContext }}:mainline/alpine-otel"
469+
labels: ${{ steps.meta.outputs.labels }}
470+
annotations: ${{ steps.meta.outputs.annotations }}
471+
tags: ${{ steps.meta.outputs.tags }}
472+
push: ${{ github.event_name != 'pull_request' }}
473+
# cache-from: type=gha,scope=alpine-otel
474+
# cache-to: type=gha,mode=min,scope=alpine-otel
475+
476+
- name: Sign Docker Hub Manifest
477+
if: ${{ github.event_name != 'pull_request' }}
478+
run: |
479+
set -ex
480+
sudo apt update
481+
sudo apt install -y notary
482+
mkdir -p ~/.docker/trust/private
483+
echo "$DOCKER_CONTENT_TRUST_REPOSITORY_KEY" > ~/.docker/trust/private/$DOCKER_CONTENT_TRUST_REPOSITORY_KEY_ID.key
484+
chmod 0400 ~/.docker/trust/private/$DOCKER_CONTENT_TRUST_REPOSITORY_KEY_ID.key
485+
docker trust key load ~/.docker/trust/private/$DOCKER_CONTENT_TRUST_REPOSITORY_KEY_ID.key --name nginx
486+
DIGEST=$(printf '${{ steps.build.outputs.metadata }}' | jq -r '."containerimage.descriptor".digest' | cut -d ':' -f2)
487+
SIZE=$(printf '${{ steps.build.outputs.metadata }}' | jq -r '."containerimage.descriptor".size')
488+
export NOTARY_AUTH=$(printf "${{ secrets.DOCKERHUB_USERNAME }}:${{ secrets.DOCKERHUB_TOKEN }}" | base64 -w0)
489+
notary -d ~/.docker/trust/ -s https://notary.docker.io addhash docker.io/nginxinc/nginx-unprivileged ${{ needs.version.outputs.major }}.${{ needs.version.outputs.minor }}.${{ needs.version.outputs.patch }}-alpine-otel $SIZE --sha256 $DIGEST --publish --verbose
490+
notary -d ~/.docker/trust/ -s https://notary.docker.io addhash docker.io/nginxinc/nginx-unprivileged ${{ needs.version.outputs.major }}.${{ needs.version.outputs.minor }}.${{ needs.version.outputs.patch }}-alpine${{ needs.version.outputs.distro }}-otel $SIZE --sha256 $DIGEST --publish --verbose
491+
notary -d ~/.docker/trust/ -s https://notary.docker.io addhash docker.io/nginxinc/nginx-unprivileged ${{ needs.version.outputs.major }}.${{ needs.version.outputs.minor }}-alpine-otel $SIZE --sha256 $DIGEST --publish --verbose
492+
notary -d ~/.docker/trust/ -s https://notary.docker.io addhash docker.io/nginxinc/nginx-unprivileged ${{ needs.version.outputs.major }}.${{ needs.version.outputs.minor }}-alpine${{ needs.version.outputs.distro }}-otel $SIZE --sha256 $DIGEST --publish --verbose
493+
notary -d ~/.docker/trust/ -s https://notary.docker.io addhash docker.io/nginxinc/nginx-unprivileged ${{ needs.version.outputs.major }}-alpine-otel $SIZE --sha256 $DIGEST --publish --verbose
494+
notary -d ~/.docker/trust/ -s https://notary.docker.io addhash docker.io/nginxinc/nginx-unprivileged ${{ needs.version.outputs.major }}-alpine${{ needs.version.outputs.distro }}-otel $SIZE --sha256 $DIGEST --publish --verbose
495+
notary -d ~/.docker/trust/ -s https://notary.docker.io addhash docker.io/nginxinc/nginx-unprivileged mainline-alpine-otel $SIZE --sha256 $DIGEST --publish --verbose
496+
notary -d ~/.docker/trust/ -s https://notary.docker.io addhash docker.io/nginxinc/nginx-unprivileged mainline-alpine${{ needs.version.outputs.distro }}-otel $SIZE --sha256 $DIGEST --publish --verbose
497+
notary -d ~/.docker/trust/ -s https://notary.docker.io addhash docker.io/nginxinc/nginx-unprivileged alpine-otel $SIZE --sha256 $DIGEST --publish --verbose
498+
notary -d ~/.docker/trust/ -s https://notary.docker.io addhash docker.io/nginxinc/nginx-unprivileged alpine${{ needs.version.outputs.distro }}-otel $SIZE --sha256 $DIGEST --publish --verbose
499+
env:
500+
DOCKER_CONTENT_TRUST_REPOSITORY_KEY: ${{ secrets.DOCKER_CONTENT_TRUST_REPOSITORY_KEY }}
501+
DOCKER_CONTENT_TRUST_REPOSITORY_KEY_ID: ${{ secrets.DOCKER_CONTENT_TRUST_REPOSITORY_KEY_ID }}
502+
DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: ${{ secrets.DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE }}
503+
NOTARY_TARGETS_PASSPHRASE: ${{ secrets.DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE }}

‎.github/workflows/alpine-stable.yml‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -359,3 +359,112 @@ jobs:
359359
DOCKER_CONTENT_TRUST_REPOSITORY_KEY_ID: ${{ secrets.DOCKER_CONTENT_TRUST_REPOSITORY_KEY_ID }}
360360
DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: ${{ secrets.DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE }}
361361
NOTARY_TARGETS_PASSPHRASE: ${{ secrets.DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE }}
362+
otel:
363+
name: Build Alpine NGINX stable otel Docker image
364+
needs: [version, core]
365+
runs-on: ubuntu-24.04
366+
strategy:
367+
fail-fast: false
368+
steps:
369+
- name: Check out the codebase
370+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
371+
372+
- name: Set up QEMU
373+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
374+
375+
- name: Set up Docker Buildx
376+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
377+
378+
- name: Configure AWS credentials
379+
if: ${{ github.event_name != 'pull_request' }}
380+
uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
381+
with:
382+
aws-region: ${{ secrets.AWS_REGION }}
383+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
384+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
385+
386+
- name: Login to Amazon ECR Public Gallery
387+
if: ${{ github.event_name != 'pull_request' }}
388+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
389+
with:
390+
registry: public.ecr.aws
391+
392+
- name: Login to Docker Hub
393+
if: ${{ github.event_name != 'pull_request' }}
394+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
395+
with:
396+
username: ${{ secrets.DOCKERHUB_USERNAME }}
397+
password: ${{ secrets.DOCKERHUB_TOKEN }}
398+
399+
- name: Login to GitHub Container Registry
400+
if: ${{ github.event_name != 'pull_request' }}
401+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
402+
with:
403+
registry: ghcr.io
404+
username: ${{ github.actor }}
405+
password: ${{ secrets.GITHUB_TOKEN }}
406+
407+
- name: Login to Quay
408+
if: ${{ github.event_name != 'pull_request' }}
409+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
410+
with:
411+
registry: quay.io
412+
username: ${{ secrets.QUAY_USERNAME }}
413+
password: ${{ secrets.QUAY_TOKEN }}
414+
415+
- name: Extract metadata (annotations, labels, tags) for Docker
416+
id: meta
417+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
418+
with:
419+
images: |
420+
docker.io/nginxinc/nginx-unprivileged
421+
ghcr.io/nginx/nginx-unprivileged
422+
public.ecr.aws/nginx/nginx-unprivileged
423+
quay.io/nginx/nginx-unprivileged
424+
tags: |
425+
type=raw,value=${{ needs.version.outputs.major }}.${{ needs.version.outputs.minor }}.${{ needs.version.outputs.patch }}-alpine-otel
426+
type=raw,value=${{ needs.version.outputs.major }}.${{ needs.version.outputs.minor }}.${{ needs.version.outputs.patch }}-alpine${{ needs.version.outputs.distro }}-otel
427+
type=raw,value=${{ needs.version.outputs.major }}.${{ needs.version.outputs.minor }}-alpine-otel
428+
type=raw,value=${{ needs.version.outputs.major }}.${{ needs.version.outputs.minor }}-alpine${{ needs.version.outputs.distro }}-otel
429+
type=raw,value=stable-alpine-otel
430+
type=raw,value=stable-alpine${{ needs.version.outputs.distro }}-otel
431+
env:
432+
DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
433+
434+
- name: Build and push NGINX stable otel Alpine image to Amazon ECR Public Gallery, Docker Hub, GitHub Container Registry, and Quay
435+
id: build
436+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
437+
with:
438+
platforms: linux/amd64, linux/arm/v6, linux/arm/v7, linux/arm64, linux/386, linux/ppc64le, linux/riscv64, linux/s390x
439+
context: "{{ defaultContext }}:stable/alpine-otel"
440+
labels: ${{ steps.meta.outputs.labels }}
441+
annotations: ${{ steps.meta.outputs.annotations }}
442+
tags: ${{ steps.meta.outputs.tags }}
443+
push: ${{ github.event_name != 'pull_request' }}
444+
# cache-from: type=gha,scope=stable-alpine-otel
445+
# cache-to: type=gha,mode=min,scope=stable-alpine-otel
446+
447+
- name: Sign Docker Hub Manifest
448+
if: ${{ github.event_name != 'pull_request' }}
449+
run: |
450+
set -ex
451+
sudo apt update
452+
sudo apt install -y notary
453+
mkdir -p ~/.docker/trust/private
454+
echo "$DOCKER_CONTENT_TRUST_REPOSITORY_KEY" > ~/.docker/trust/private/$DOCKER_CONTENT_TRUST_REPOSITORY_KEY_ID.key
455+
chmod 0400 ~/.docker/trust/private/$DOCKER_CONTENT_TRUST_REPOSITORY_KEY_ID.key
456+
docker trust key load ~/.docker/trust/private/$DOCKER_CONTENT_TRUST_REPOSITORY_KEY_ID.key --name nginx
457+
DIGEST=$(printf '${{ steps.build.outputs.metadata }}' | jq -r '."containerimage.descriptor".digest' | cut -d ':' -f2)
458+
SIZE=$(printf '${{ steps.build.outputs.metadata }}' | jq -r '."containerimage.descriptor".size')
459+
export NOTARY_AUTH=$(printf "${{ secrets.DOCKERHUB_USERNAME }}:${{ secrets.DOCKERHUB_TOKEN }}" | base64 -w0)
460+
notary -d ~/.docker/trust/ -s https://notary.docker.io addhash docker.io/nginxinc/nginx-unprivileged ${{ needs.version.outputs.major }}.${{ needs.version.outputs.minor }}.${{ needs.version.outputs.patch }}-alpine-otel $SIZE --sha256 $DIGEST --publish --verbose
461+
notary -d ~/.docker/trust/ -s https://notary.docker.io addhash docker.io/nginxinc/nginx-unprivileged ${{ needs.version.outputs.major }}.${{ needs.version.outputs.minor }}.${{ needs.version.outputs.patch }}-alpine${{ needs.version.outputs.distro }}-otel $SIZE --sha256 $DIGEST --publish --verbose
462+
notary -d ~/.docker/trust/ -s https://notary.docker.io addhash docker.io/nginxinc/nginx-unprivileged ${{ needs.version.outputs.major }}.${{ needs.version.outputs.minor }}-alpine-otel $SIZE --sha256 $DIGEST --publish --verbose
463+
notary -d ~/.docker/trust/ -s https://notary.docker.io addhash docker.io/nginxinc/nginx-unprivileged ${{ needs.version.outputs.major }}.${{ needs.version.outputs.minor }}-alpine${{ needs.version.outputs.distro }}-otel $SIZE --sha256 $DIGEST --publish --verbose
464+
notary -d ~/.docker/trust/ -s https://notary.docker.io addhash docker.io/nginxinc/nginx-unprivileged stable-alpine-otel $SIZE --sha256 $DIGEST --publish --verbose
465+
notary -d ~/.docker/trust/ -s https://notary.docker.io addhash docker.io/nginxinc/nginx-unprivileged stable-alpine${{ needs.version.outputs.distro }}-otel $SIZE --sha256 $DIGEST --publish --verbose
466+
env:
467+
DOCKER_CONTENT_TRUST_REPOSITORY_KEY: ${{ secrets.DOCKER_CONTENT_TRUST_REPOSITORY_KEY }}
468+
DOCKER_CONTENT_TRUST_REPOSITORY_KEY_ID: ${{ secrets.DOCKER_CONTENT_TRUST_REPOSITORY_KEY_ID }}
469+
DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: ${{ secrets.DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE }}
470+
NOTARY_TARGETS_PASSPHRASE: ${{ secrets.DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE }}

0 commit comments

Comments
 (0)