chore: sync with WeblateOrg/meta #4039
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright © Michal Čihař <michal@weblate.org> | |
| # | |
| # SPDX-License-Identifier: GPL-3.0-or-later | |
| name: Docker Image CI | |
| on: | |
| push: | |
| branches-ignore: | |
| - renovate/** | |
| - dependabot/** | |
| tags: | |
| - '*' | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| build: | |
| runs-on: ubuntu-24.04 | |
| name: Build, linux/${{ matrix.architecture }} | |
| strategy: | |
| matrix: | |
| architecture: | |
| - amd64 | |
| env: | |
| MATRIX_ARCHITECTURE: linux/${{ matrix.architecture }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| - name: Configure Docker build | |
| run: .github/bin/get-buildx-args | |
| - name: Build the Docker image | |
| run: .github/bin/docker-build | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: Docker cache ${{ matrix.architecture }} | |
| path: /tmp/.buildx-cache/linux/${{ matrix.architecture }} | |
| retention-days: 1 | |
| buildx: | |
| runs-on: ubuntu-24.04-arm | |
| name: Build, linux/${{ matrix.architecture }} | |
| strategy: | |
| matrix: | |
| architecture: | |
| - arm64 | |
| env: | |
| MATRIX_ARCHITECTURE: linux/${{ matrix.architecture }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| - name: Configure Docker build | |
| run: .github/bin/get-buildx-args | |
| - name: Build the Docker image | |
| run: .github/bin/docker-build | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: Docker cache ${{ matrix.architecture }} | |
| path: /tmp/.buildx-cache/linux/${{ matrix.architecture }} | |
| retention-days: 1 | |
| test: | |
| runs-on: ubuntu-24.04 | |
| name: Test, ${{ matrix.architecture }} | |
| needs: [build] | |
| strategy: | |
| matrix: | |
| architecture: [linux/amd64] | |
| env: | |
| MATRIX_ARCHITECTURE: ${{ matrix.architecture }} | |
| COMPOSE_PROJECT_NAME: wl | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: Docker cache amd64 | |
| path: /tmp/.buildx-cache/linux/amd64 | |
| - name: Build the Docker image | |
| run: .github/bin/docker-build load | |
| - name: List Docker images | |
| run: docker image ls --all | |
| - name: Test the Docker image | |
| run: docker run --rm weblate/wlc:test version | grep "version" | |
| anchore: | |
| runs-on: ubuntu-24.04 | |
| name: Anchore Container Scan, ${{ matrix.architecture }} | |
| needs: | |
| - build | |
| permissions: | |
| security-events: write | |
| strategy: | |
| matrix: | |
| architecture: [linux/amd64] | |
| env: | |
| MATRIX_ARCHITECTURE: ${{ matrix.architecture }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: Docker cache amd64 | |
| path: /tmp/.buildx-cache/linux/amd64 | |
| - name: Build the Docker image | |
| run: .github/bin/docker-build load | |
| - name: List Docker images | |
| run: docker image ls --all | |
| - name: Checkout the code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Anchore scan action | |
| uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0 | |
| id: scan | |
| with: | |
| image: weblate/wlc:test | |
| fail-build: false | |
| severity-cutoff: high | |
| - name: Upload Anchore Scan Report | |
| uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 | |
| with: | |
| sarif_file: ${{ steps.scan.outputs.sarif }} | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: Anchore scan SARIF | |
| path: ${{ steps.scan.outputs.sarif }} | |
| trivy: | |
| runs-on: ubuntu-24.04 | |
| name: Trivy Container Scan, ${{ matrix.architecture }} | |
| needs: | |
| - build | |
| permissions: | |
| security-events: write | |
| strategy: | |
| matrix: | |
| architecture: [linux/amd64] | |
| env: | |
| MATRIX_ARCHITECTURE: ${{ matrix.architecture }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: Docker cache amd64 | |
| path: /tmp/.buildx-cache/linux/amd64 | |
| - name: Build the Docker image | |
| run: .github/bin/docker-build load | |
| - name: List Docker images | |
| run: docker image ls --all | |
| - name: Checkout the code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: weblate/wlc:test | |
| format: template | |
| template: '@/contrib/sarif.tpl' | |
| output: trivy-results.sarif | |
| severity: CRITICAL,HIGH | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 | |
| with: | |
| sarif_file: trivy-results.sarif | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: Trivy scan SARIF | |
| path: trivy-results.sarif | |
| push_dockerhub: | |
| runs-on: ubuntu-24.04 | |
| name: Publish to Docker Hub | |
| permissions: | |
| artifact-metadata: write | |
| attestations: write | |
| contents: read | |
| id-token: write | |
| needs: | |
| - test | |
| - buildx | |
| - anchore | |
| - trivy | |
| if: ${{ (startsWith(github.ref, 'refs/tags/') || (github.ref == 'refs/heads/main')) && github.repository == 'WeblateOrg/wlc' }} | |
| env: | |
| BUILDX_METADATA_FILE: /tmp/dockerhub-buildx-metadata.json | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 | |
| with: | |
| platforms: all | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| with: | |
| cosign-release: v2.6.0 | |
| - name: Install Syft | |
| id: syft | |
| uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 | |
| with: | |
| syft-version: v1.38.0 | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: Docker cache amd64 | |
| path: /tmp/.buildx-cache/linux/amd64 | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: Docker cache arm64 | |
| path: /tmp/.buildx-cache/linux/arm64 | |
| - name: DockerHub login | |
| env: | |
| DOCKERHUB_ACCESS_TOKEN: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }} # zizmor: ignore[secrets-outside-env] | |
| DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} # zizmor: ignore[secrets-outside-env] | |
| run: echo "$DOCKERHUB_ACCESS_TOKEN" | docker login --username "$DOCKERHUB_USERNAME" --password-stdin | |
| - name: Configure Docker build | |
| run: .github/bin/get-buildx-args publish | |
| - name: Publish the Docker images | |
| run: .github/bin/docker-build publish | |
| - name: Export image digest | |
| id: image | |
| env: | |
| IMAGE_NAME: docker.io/weblate/wlc | |
| run: | | |
| DIGEST="$(jq -r '."containerimage.digest"' "$BUILDX_METADATA_FILE")" | |
| test -n "$DIGEST" | |
| test "$DIGEST" != "null" | |
| { | |
| echo "digest=$DIGEST" | |
| echo "name=$IMAGE_NAME" | |
| echo "ref=$IMAGE_NAME@$DIGEST" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Sign image | |
| env: | |
| IMAGE_REF: ${{ steps.image.outputs.ref }} | |
| run: cosign sign --yes "$IMAGE_REF" | |
| - name: Generate image SBOM | |
| env: | |
| IMAGE_REF: ${{ steps.image.outputs.ref }} | |
| SYFT: ${{ steps.syft.outputs.cmd }} | |
| run: | | |
| "$SYFT" "$IMAGE_REF" --scope all-layers -o cyclonedx-json=dockerhub-image.cdx.json | |
| - name: Attest image provenance | |
| uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 | |
| with: | |
| subject-name: ${{ steps.image.outputs.name }} | |
| subject-digest: ${{ steps.image.outputs.digest }} | |
| push-to-registry: true | |
| - name: Attest image SBOM | |
| uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 | |
| with: | |
| subject-name: ${{ steps.image.outputs.name }} | |
| subject-digest: ${{ steps.image.outputs.digest }} | |
| sbom-path: dockerhub-image.cdx.json | |
| push-to-registry: true | |
| push_github: | |
| runs-on: ubuntu-24.04 | |
| name: Publish to GitHub | |
| permissions: | |
| artifact-metadata: write | |
| attestations: write | |
| contents: read | |
| id-token: write | |
| packages: write | |
| needs: | |
| - test | |
| - buildx | |
| - anchore | |
| - trivy | |
| if: ${{ (startsWith(github.ref, 'refs/tags/') || (github.ref == 'refs/heads/main')) && github.repository == 'WeblateOrg/wlc' }} | |
| env: | |
| BUILDX_METADATA_FILE: /tmp/ghcr-buildx-metadata.json | |
| DOCKER_IMAGE: ghcr.io/weblateorg/wlc | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 | |
| with: | |
| platforms: all | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| with: | |
| cosign-release: v2.6.0 | |
| - name: Install Syft | |
| id: syft | |
| uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 | |
| with: | |
| syft-version: v1.38.0 | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: Docker cache amd64 | |
| path: /tmp/.buildx-cache/linux/amd64 | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: Docker cache arm64 | |
| path: /tmp/.buildx-cache/linux/arm64 | |
| - name: Login to GitHub Container Registry | |
| if: ${{ github.event_name != 'pull_request'}} | |
| uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Configure Docker build | |
| run: .github/bin/get-buildx-args publish | |
| - name: Publish the Docker images | |
| run: .github/bin/docker-build publish | |
| - name: Export image digest | |
| id: image | |
| env: | |
| IMAGE_NAME: ghcr.io/weblateorg/wlc | |
| run: | | |
| DIGEST="$(jq -r '."containerimage.digest"' "$BUILDX_METADATA_FILE")" | |
| test -n "$DIGEST" | |
| test "$DIGEST" != "null" | |
| { | |
| echo "digest=$DIGEST" | |
| echo "name=$IMAGE_NAME" | |
| echo "ref=$IMAGE_NAME@$DIGEST" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Sign image | |
| env: | |
| IMAGE_REF: ${{ steps.image.outputs.ref }} | |
| run: cosign sign --yes "$IMAGE_REF" | |
| - name: Generate image SBOM | |
| env: | |
| IMAGE_REF: ${{ steps.image.outputs.ref }} | |
| SYFT: ${{ steps.syft.outputs.cmd }} | |
| run: | | |
| "$SYFT" "$IMAGE_REF" --scope all-layers -o cyclonedx-json=ghcr-image.cdx.json | |
| - name: Attest image provenance | |
| uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 | |
| with: | |
| subject-name: ${{ steps.image.outputs.name }} | |
| subject-digest: ${{ steps.image.outputs.digest }} | |
| push-to-registry: true | |
| - name: Attest image SBOM | |
| uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 | |
| with: | |
| subject-name: ${{ steps.image.outputs.name }} | |
| subject-digest: ${{ steps.image.outputs.digest }} | |
| sbom-path: ghcr-image.cdx.json | |
| push-to-registry: true |