Skip to content

Commit 7771c78

Browse files
ciarams87ciarams87
committed
Add build to ci for now
1 parent 51dd410 commit 7771c78

File tree

1 file changed

+256
-10
lines changed

1 file changed

+256
-10
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 256 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -201,36 +201,282 @@ jobs:
201201

202202
build-oss:
203203
name: Build OSS images
204+
runs-on: ${{ github.repository_owner == 'nginx' && (github.ref_type == 'tag' || (github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/chore/secure-build-pipeline'))) && 'ubuntu-24.04-amd64' || 'ubuntu-24.04' }}
204205
needs: [vars, binary]
205206
strategy:
206207
fail-fast: false
207208
matrix:
208209
image: [ngf, nginx]
209210
platforms: ["linux/arm64, linux/amd64"]
210-
uses: ./.github/workflows/build.yml
211-
with:
212-
image: ${{ matrix.image }}
213-
platforms: ${{ matrix.platforms }}
214211
permissions:
215212
contents: read # for docker/build-push-action to read repo content
216213
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
217214
packages: write # for docker/build-push-action to push to GHCR
218215
id-token: write # for docker/login to login to NGINX registry
219-
secrets: inherit
216+
services:
217+
registry:
218+
image: registry:3
219+
ports:
220+
- 5000:5000
221+
steps:
222+
- name: Checkout Repository
223+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
224+
225+
- name: Fetch Cached Artifacts
226+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
227+
with:
228+
path: ${{ github.workspace }}/dist
229+
key: nginx-gateway-fabric-${{ github.run_id }}-${{ github.run_number }}
230+
231+
- name: Docker Buildx
232+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
233+
with:
234+
driver-opts: network=host
235+
236+
- name: Setup QEMU
237+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
238+
with:
239+
platforms: arm64
240+
241+
- name: Login to GitHub Container Registry
242+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
243+
if: ${{ github.event_name != 'pull_request' && ! contains(matrix.image, 'plus') }}
244+
with:
245+
registry: ghcr.io
246+
username: ${{ github.repository_owner }}
247+
password: ${{ secrets.GITHUB_TOKEN }}
248+
249+
- name: Docker meta
250+
id: meta
251+
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
252+
with:
253+
context: workflow
254+
images: |
255+
name=ghcr.io/${{ github.repository_owner }}/nginx-gateway-fabric,enable=${{ matrix.image == 'ngf' && github.event_name != 'pull_request' }}
256+
name=ghcr.io/${{ github.repository_owner }}/nginx-gateway-fabric/nginx,enable=${{ matrix.image == 'nginx' && github.event_name != 'pull_request' }}
257+
name=localhost:5000/nginx-gateway-fabric/${{ matrix.image }}
258+
flavor: |
259+
latest=auto
260+
tags: |
261+
type=semver,pattern={{version}}
262+
type=edge
263+
type=schedule
264+
type=ref,event=pr
265+
type=ref,event=branch,suffix=-rc,enable=${{ startsWith(github.ref, 'refs/heads/release') }}
266+
labels: |
267+
org.opencontainers.image.documentation=https://docs.nginx.com/nginx-gateway-fabric
268+
org.opencontainers.image.vendor=NGINX Inc <[email protected]>
269+
annotations: |
270+
org.opencontainers.image.documentation=https://docs.nginx.com/nginx-gateway-fabric
271+
org.opencontainers.image.vendor=NGINX Inc <[email protected]>
272+
io.artifacthub.package.readme-url=https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/main/README.md
273+
io.artifacthub.package.logo-url=https://docs.nginx.com/nginx-gateway-fabric/images/icons/NGINX-product-icon.svg
274+
io.artifacthub.package.maintainers=[{"name":"NGINX Inc","email":"[email protected]"}]
275+
io.artifacthub.package.license=Apache-2.0
276+
io.artifacthub.package.keywords=kubernetes,gateway,nginx
277+
env:
278+
DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
279+
280+
- name: Debug Docker Meta Outputs
281+
run: |
282+
echo "Tags: ${{ steps.meta.outputs.tags }}"
283+
echo "Labels: ${{ steps.meta.outputs.labels }}"
284+
echo "Version: ${{ steps.meta.outputs.version }}"
285+
286+
- name: Build Docker Image
287+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
288+
with:
289+
file: build/Dockerfile${{ matrix.image == 'nginx' && '.nginx' || '' }}
290+
context: "."
291+
target: ${{ matrix.image == 'ngf' && 'goreleaser' || '' }}
292+
tags: ${{ steps.meta.outputs.tags }}
293+
labels: ${{ steps.meta.outputs.labels }}
294+
annotations: ${{ steps.meta.outputs.annotations }}
295+
push: false
296+
platforms: ${{ matrix.platforms }}
297+
cache-from: type=gha,scope=${{ matrix.image }}
298+
cache-to: type=gha,scope=${{ matrix.image }},mode=max
299+
pull: true
300+
no-cache: ${{ github.event_name != 'pull_request' }}
301+
sbom: true
302+
provenance: mode=max
303+
build-args: |
304+
NJS_DIR=internal/controller/nginx/modules/src
305+
NGINX_CONF_DIR=internal/controller/nginx/conf
306+
BUILD_AGENT=gha
307+
308+
- name: Inspect SBOM and output manifest
309+
run: |
310+
docker buildx imagetools inspect localhost:5000/nginx-gateway-fabric/${{ matrix.image }}:${{ steps.meta.outputs.version }} --format '{{ json (index .SBOM "linux/amd64").SPDX }}' > sbom-${{ matrix.image }}.json
311+
docker buildx imagetools inspect localhost:5000/nginx-gateway-fabric/${{ matrix.image }}:${{ steps.meta.outputs.version }} --raw
312+
313+
- name: Scan SBOM
314+
id: scan
315+
uses: anchore/scan-action@1638637db639e0ade3258b51db49a9a137574c3e # v6.5.1
316+
with:
317+
sbom: "sbom-${{ matrix.image }}.json"
318+
only-fixed: true
319+
add-cpes-if-none: true
320+
fail-build: false
321+
322+
- name: Upload scan result to GitHub Security tab
323+
uses: github/codeql-action/upload-sarif@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
324+
continue-on-error: true
325+
with:
326+
sarif_file: ${{ steps.scan.outputs.sarif }}
327+
category: build-${{ matrix.image }}
328+
if: always()
220329

221330
build-plus:
222331
name: Build Plus images
332+
runs-on: ${{ github.repository_owner == 'nginx' && (github.ref_type == 'tag' || (github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/chore/secure-build-pipeline'))) && 'ubuntu-24.04-amd64' || 'ubuntu-24.04' }}
223333
needs: [vars, binary]
224-
uses: ./.github/workflows/build.yml
225-
with:
226-
image: plus
227-
platforms: "linux/arm64, linux/amd64"
228334
permissions:
229335
contents: read # for docker/build-push-action to read repo content
230336
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
231337
packages: write # for docker/build-push-action to push to GHCR
232338
id-token: write # for docker/login to login to NGINX registry
233-
secrets: inherit
339+
services:
340+
registry:
341+
image: registry:3
342+
ports:
343+
- 5000:5000
344+
steps:
345+
- name: Checkout Repository
346+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
347+
348+
- name: Fetch Cached Artifacts
349+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
350+
with:
351+
path: ${{ github.workspace }}/dist
352+
key: nginx-gateway-fabric-${{ github.run_id }}-${{ github.run_number }}
353+
354+
- name: Docker Buildx
355+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
356+
with:
357+
driver-opts: network=host
358+
359+
- name: Setup QEMU
360+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
361+
with:
362+
platforms: arm64
363+
364+
- name: Get Id Token
365+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
366+
id: idtoken
367+
with:
368+
script: |
369+
let id_token = await core.getIDToken()
370+
core.setOutput('id_token', id_token)
371+
if: ${{ github.event_name != 'pull_request' }}
372+
373+
- name: Login to NGINX Registry
374+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
375+
with:
376+
registry: docker-mgmt.nginx.com
377+
username: ${{ steps.idtoken.outputs.id_token }}
378+
password: ${{ github.actor }}
379+
if: ${{ github.event_name != 'pull_request' }}
380+
381+
- name: Authenticate to Google Cloud
382+
id: auth
383+
uses: google-github-actions/auth@b7593ed2efd1c1617e1b0254da33b86225adb2a5 # v2.1.12
384+
with:
385+
token_format: access_token
386+
workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY }}
387+
service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
388+
if: ${{ github.event_name != 'pull_request' }}
389+
390+
- name: Login to GAR
391+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
392+
with:
393+
registry: us-docker.pkg.dev
394+
username: oauth2accesstoken
395+
password: ${{ steps.auth.outputs.access_token }}
396+
if: ${{ github.event_name != 'pull_request' }}
397+
398+
- name: Docker meta
399+
id: meta
400+
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
401+
with:
402+
context: workflow
403+
images: |
404+
name=docker-mgmt.nginx.com/nginx-gateway-fabric/nginx-plus,enable=${{ github.event_name != 'pull_request' }}
405+
name=us-docker.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/nginx-gateway-fabric/nginx-plus,enable=${{ github.event_name != 'pull_request' }}
406+
name=localhost:5000/nginx-gateway-fabric/plus
407+
flavor: |
408+
latest=auto
409+
tags: |
410+
type=semver,pattern={{version}}
411+
type=edge
412+
type=schedule
413+
type=ref,event=pr
414+
type=ref,event=branch,suffix=-rc,enable=${{ startsWith(github.ref, 'refs/heads/release') }}
415+
labels: |
416+
org.opencontainers.image.documentation=https://docs.nginx.com/nginx-gateway-fabric
417+
org.opencontainers.image.vendor=NGINX Inc <[email protected]>
418+
annotations: |
419+
org.opencontainers.image.documentation=https://docs.nginx.com/nginx-gateway-fabric
420+
org.opencontainers.image.vendor=NGINX Inc <[email protected]>
421+
io.artifacthub.package.readme-url=https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/main/README.md
422+
io.artifacthub.package.logo-url=https://docs.nginx.com/nginx-gateway-fabric/images/icons/NGINX-product-icon.svg
423+
io.artifacthub.package.maintainers=[{"name":"NGINX Inc","email":"[email protected]"}]
424+
io.artifacthub.package.license=Apache-2.0
425+
io.artifacthub.package.keywords=kubernetes,gateway,nginx
426+
env:
427+
DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
428+
429+
- name: Debug Docker Meta Outputs
430+
run: |
431+
echo "Tags: ${{ steps.meta.outputs.tags }}"
432+
echo "Labels: ${{ steps.meta.outputs.labels }}"
433+
echo "Version: ${{ steps.meta.outputs.version }}"
434+
435+
- name: Build Docker Image
436+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
437+
with:
438+
file: build/Dockerfile.nginxplus
439+
context: "."
440+
tags: ${{ steps.meta.outputs.tags }}
441+
labels: ${{ steps.meta.outputs.labels }}
442+
annotations: ${{ steps.meta.outputs.annotations }}
443+
push: false
444+
platforms: "linux/arm64, linux/amd64"
445+
cache-from: type=gha,scope=plus
446+
cache-to: type=gha,scope=plus,mode=max
447+
pull: true
448+
no-cache: ${{ github.event_name != 'pull_request' }}
449+
sbom: true
450+
provenance: mode=max
451+
build-args: |
452+
NJS_DIR=internal/controller/nginx/modules/src
453+
NGINX_CONF_DIR=internal/controller/nginx/conf
454+
BUILD_AGENT=gha
455+
secrets: |
456+
"nginx-repo.crt=${{ secrets.NGINX_CRT }}"
457+
"nginx-repo.key=${{ secrets.NGINX_KEY }}"
458+
459+
- name: Inspect SBOM and output manifest
460+
run: |
461+
docker buildx imagetools inspect localhost:5000/nginx-gateway-fabric/plus:${{ steps.meta.outputs.version }} --format '{{ json (index .SBOM "linux/amd64").SPDX }}' > sbom-plus.json
462+
docker buildx imagetools inspect localhost:5000/nginx-gateway-fabric/plus:${{ steps.meta.outputs.version }} --raw
463+
464+
- name: Scan SBOM
465+
id: scan
466+
uses: anchore/scan-action@1638637db639e0ade3258b51db49a9a137574c3e # v6.5.1
467+
with:
468+
sbom: "sbom-plus.json"
469+
only-fixed: true
470+
add-cpes-if-none: true
471+
fail-build: false
472+
473+
- name: Upload scan result to GitHub Security tab
474+
uses: github/codeql-action/upload-sarif@51f77329afa6477de8c49fc9c7046c15b9a4e79d # v3.29.5
475+
continue-on-error: true
476+
with:
477+
sarif_file: ${{ steps.scan.outputs.sarif }}
478+
category: build-plus
479+
if: always()
234480

235481
functional-tests:
236482
name: Functional tests

0 commit comments

Comments
 (0)