Skip to content

Commit 6437c2e

Browse files
ynojimaynojima
committed
Polish SBOM and provenance generation workflow
1 parent d0def61 commit 6437c2e

3 files changed

Lines changed: 152 additions & 31 deletions

File tree

‎.github/workflows/publish-nightly.yml‎

Lines changed: 45 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Publish Nightly Docker Image
1+
name: Publish Nightly Container Images
22

33
on:
44
push:
@@ -11,38 +11,32 @@ permissions:
1111

1212
jobs:
1313
push-to-ghcr:
14-
name: Build and Push Docker Image to GHCR
14+
name: Build and Push Nightly to GHCR (Docker toolchain)
1515
runs-on: ubuntu-latest
1616

1717
steps:
1818
- name: Check out the repo
1919
uses: actions/checkout@v6
2020

21-
- name: Log in to the GitHub Container Registry
21+
- name: Log in to GHCR
2222
uses: docker/login-action@v3
2323
with:
2424
registry: ghcr.io
2525
username: ${{ github.actor }}
2626
password: ${{ secrets.GITHUB_TOKEN }}
2727

28-
- name: Log in to Quay.io
29-
uses: docker/login-action@v3
30-
with:
31-
registry: quay.io
32-
username: ${{ secrets.QUAY_BOT_USERNAME }}
33-
password: ${{ secrets.QUAY_BOT_TOKEN }}
28+
- name: Set up Docker Buildx
29+
uses: docker/setup-buildx-action@v3
3430

35-
- name: Extract metadata (tags, labels) for Docker
31+
- name: Extract metadata (GHCR)
3632
id: meta
3733
uses: docker/metadata-action@v5
3834
with:
39-
images: |
40-
ghcr.io/${{ github.repository }}
41-
quay.io/sharplab/switchbot-mcp-server
35+
images: ghcr.io/${{ github.repository }}
4236
tags: |
4337
type=raw,value=nightly
4438
45-
- name: Build and push Docker image
39+
- name: Build and push (GHCR)
4640
uses: docker/build-push-action@v6
4741
with:
4842
context: .
@@ -52,3 +46,40 @@ jobs:
5246
labels: ${{ steps.meta.outputs.labels }}
5347
provenance: true
5448
sbom: true
49+
50+
push-to-quay:
51+
name: Build and Push Nightly to Quay (Red Hat toolchain)
52+
runs-on: ubuntu-latest
53+
54+
env:
55+
REGISTRY: quay.io
56+
IMAGE: sharplab/switchbot-mcp-server
57+
TAG: nightly
58+
59+
steps:
60+
- name: Check out the repo
61+
uses: actions/checkout@v6
62+
63+
- name: Log in to Quay.io
64+
uses: redhat-actions/podman-login@v1
65+
with:
66+
registry: ${{ env.REGISTRY }}
67+
username: ${{ secrets.QUAY_BOT_USERNAME }}
68+
password: ${{ secrets.QUAY_BOT_TOKEN }}
69+
70+
- name: Build image (buildah)
71+
id: build_image
72+
uses: redhat-actions/buildah-build@v2
73+
with:
74+
image: ${{ env.IMAGE }}
75+
tags: ${{ env.TAG }}
76+
containerfiles: |
77+
./switchbot-mcp-server/src/main/docker/Dockerfile
78+
context: .
79+
80+
- name: Push to Quay
81+
uses: redhat-actions/push-to-registry@v2
82+
with:
83+
image: ${{ steps.build_image.outputs.image }}
84+
tags: ${{ steps.build_image.outputs.tags }}
85+
registry: ${{ env.REGISTRY }}

‎.github/workflows/rebuild-tagged-releases.yml‎

Lines changed: 49 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,8 @@ jobs:
2828
tags=$(git ls-remote --tags --refs | grep -o 'refs/tags/.*\.RELEASE$' | sed 's#refs/tags/##' | jq -c -R -s 'split("\n") | map(select(length > 0))')
2929
echo "tags=${tags}" >> $GITHUB_OUTPUT
3030
31-
rebuild:
32-
name: Rebuild and Push Tagged Release
31+
rebuild-ghcr:
32+
name: Rebuild and Push to GHCR
3333
runs-on: ubuntu-latest
3434
needs: list-tags
3535
if: needs.list-tags.outputs.tags != '[]'
@@ -52,20 +52,15 @@ jobs:
5252
username: ${{ github.actor }}
5353
password: ${{ secrets.GITHUB_TOKEN }}
5454

55-
- name: Log in to Quay.io
56-
uses: docker/login-action@v3
57-
with:
58-
registry: quay.io
59-
username: ${{ secrets.QUAY_BOT_USERNAME }}
60-
password: ${{ secrets.QUAY_BOT_TOKEN }}
55+
- name: Set up Docker Buildx
56+
uses: docker/setup-buildx-action@v3
6157

6258
- name: Extract metadata (tags, labels) for Docker
6359
id: meta
6460
uses: docker/metadata-action@v5
6561
with:
6662
images: |
6763
ghcr.io/${{ github.repository }}
68-
quay.io/sharplab/switchbot-mcp-server
6964
tags: |
7065
type=raw,value=${{ matrix.tag }}
7166
@@ -79,3 +74,48 @@ jobs:
7974
labels: ${{ steps.meta.outputs.labels }}
8075
provenance: true
8176
sbom: true
77+
78+
rebuild-quay:
79+
name: Rebuild and Push to Quay
80+
runs-on: ubuntu-latest
81+
needs: list-tags
82+
if: needs.list-tags.outputs.tags != '[]'
83+
84+
strategy:
85+
fail-fast: false
86+
matrix:
87+
tag: ${{ fromJson(needs.list-tags.outputs.tags) }}
88+
89+
env:
90+
REGISTRY: quay.io
91+
IMAGE: sharplab/switchbot-mcp-server
92+
93+
steps:
94+
- name: Check out the repo at a specific tag
95+
uses: actions/checkout@v6
96+
with:
97+
ref: ${{ matrix.tag }}
98+
99+
- name: Log in to Quay.io
100+
uses: redhat-actions/podman-login@v1
101+
with:
102+
registry: ${{ env.REGISTRY }}
103+
username: ${{ secrets.QUAY_BOT_USERNAME }}
104+
password: ${{ secrets.QUAY_BOT_TOKEN }}
105+
106+
- name: Build image (buildah)
107+
id: build_image
108+
uses: redhat-actions/buildah-build@v2
109+
with:
110+
image: ${{ env.IMAGE }}
111+
tags: ${{ matrix.tag }}
112+
containerfiles: |
113+
./switchbot-mcp-server/src/main/docker/Dockerfile
114+
context: .
115+
116+
- name: Push to Quay
117+
uses: redhat-actions/push-to-registry@v2
118+
with:
119+
image: ${{ steps.build_image.outputs.image }}
120+
tags: ${{ steps.build_image.outputs.tags }}
121+
registry: ${{ env.REGISTRY }}

‎.github/workflows/release.yml‎

Lines changed: 58 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ jobs:
1212
permissions:
1313
contents: write
1414
packages: write
15+
outputs:
16+
release_tag: ${{ steps.tag_commit.outputs.release_tag }}
1517

1618
runs-on: ubuntu-latest
1719

@@ -93,29 +95,37 @@ jobs:
9395
asset_name: switchbot-mcp-server.jar
9496
asset_content_type: application/java-archive
9597

98+
push-to-ghcr:
99+
permissions:
100+
contents: read
101+
packages: write
102+
needs:
103+
- release
104+
runs-on: ubuntu-latest
105+
steps:
106+
- name: Checkout
107+
uses: actions/checkout@v6
108+
with:
109+
ref: ${{ needs.release.outputs.release_tag }}
110+
96111
- name: Log in to the GitHub Container Registry
97112
uses: docker/login-action@v3
98113
with:
99114
registry: ghcr.io
100115
username: ${{ github.actor }}
101116
password: ${{ secrets.GITHUB_TOKEN }}
102117

103-
- name: Log in to Quay.io
104-
uses: docker/login-action@v3
105-
with:
106-
registry: quay.io
107-
username: ${{ secrets.QUAY_BOT_USERNAME }}
108-
password: ${{ secrets.QUAY_BOT_TOKEN }}
118+
- name: Set up Docker Buildx
119+
uses: docker/setup-buildx-action@v3
109120

110121
- name: Extract metadata (tags, labels) for Docker
111122
id: meta
112123
uses: docker/metadata-action@v5
113124
with:
114125
images: |
115126
ghcr.io/${{ github.repository }}
116-
quay.io/sharplab/switchbot-mcp-server
117127
tags: |
118-
type=raw,value=${{ steps.tag_commit.outputs.release_tag }}
128+
type=raw,value=${{ needs.release.outputs.release_tag }}
119129
120130
- name: Build and push Docker image
121131
uses: docker/build-push-action@v6
@@ -127,3 +137,43 @@ jobs:
127137
labels: ${{ steps.meta.outputs.labels }}
128138
provenance: true
129139
sbom: true
140+
141+
push-to-quay:
142+
permissions:
143+
contents: read
144+
packages: write
145+
needs:
146+
- release
147+
runs-on: ubuntu-latest
148+
env:
149+
REGISTRY: quay.io
150+
IMAGE: sharplab/switchbot-mcp-server
151+
steps:
152+
- name: Checkout
153+
uses: actions/checkout@v6
154+
with:
155+
ref: ${{ needs.release.outputs.release_tag }}
156+
157+
- name: Log in to Quay.io
158+
uses: redhat-actions/podman-login@v1
159+
with:
160+
registry: ${{ env.REGISTRY }}
161+
username: ${{ secrets.QUAY_BOT_USERNAME }}
162+
password: ${{ secrets.QUAY_BOT_TOKEN }}
163+
164+
- name: Build image (buildah)
165+
id: build_image
166+
uses: redhat-actions/buildah-build@v2
167+
with:
168+
image: ${{ env.IMAGE }}
169+
tags: ${{ needs.release.outputs.release_tag }}
170+
containerfiles: |
171+
./switchbot-mcp-server/src/main/docker/Dockerfile
172+
context: .
173+
174+
- name: Push to Quay
175+
uses: redhat-actions/push-to-registry@v2
176+
with:
177+
image: ${{ steps.build_image.outputs.image }}
178+
tags: ${{ steps.build_image.outputs.tags }}
179+
registry: ${{ env.REGISTRY }}

0 commit comments

Comments
 (0)