tools/.github/workflows/build.yaml at 45d46d301b8c73d8da5e13bd3c387c90a58f197e · getarcaneapp/tools · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
name: Build and Publish

on:
  pull_request:
  push:
    branches:
      - main
    tags:
      - "v*"
  workflow_dispatch:

permissions:
  artifact-metadata: write
  attestations: write
  contents: read
  packages: write
  id-token: write

jobs:
  validate:
    if: ${{ github.repository_owner != 'getarcaneapp' && github.actor !=
      'getarcaneappbot' }}
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Install just
        uses: extractions/setup-just@v3

      - name: Install yq
        run: |
          sudo curl -fsSL -o /usr/local/bin/yq \
            https://github.com/mikefarah/yq/releases/download/v4.45.1/yq_linux_amd64
          sudo chmod +x /usr/local/bin/yq

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Build validation image
        run: just build-ci

      - name: Validate runtime contract
        run: just validate

  publish:
    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
    needs: validate
    runs-on: depot-ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Install just
        uses: extractions/setup-just@v3

      - name: Install yq
        run: |
          sudo curl -fsSL -o /usr/local/bin/yq \
            https://github.com/mikefarah/yq/releases/download/v4.45.1/yq_linux_amd64
          sudo chmod +x /usr/local/bin/yq

      - name: Resolve build inputs from build.yaml
        id: cfg
        run: |
          just prepare
          {
            echo "alpine=$(yq -r '.versions.alpine' build.yaml)"
            echo "trivy=$(yq -r '.versions.trivy' build.yaml)"
            echo "busybox=$(yq -r '.versions.busybox' build.yaml)"
            echo "platforms=$(yq -r '.platforms.publish | join(",")' build.yaml)"
            echo "image=$(yq -r '.image.name' build.yaml)"
          } >> "$GITHUB_OUTPUT"

      - name: Set up Depot CLI
        uses: depot/setup-action@v1

      - name: Install cosign
        uses: sigstore/cosign-installer@v4.1.1

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Derive image metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ steps.cfg.outputs.image }}
          flavor: |
            latest=true
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}
            type=sha

      - name: Build and publish image
        id: build
        uses: depot/build-push-action@v1
        with:
          project: np622krb2x
          context: .
          file: ./Dockerfile
          platforms: ${{ steps.cfg.outputs.platforms }}
          push: true
          build-args: |
            ALPINE_VERSION=${{ steps.cfg.outputs.alpine }}
            TRIVY_VERSION=${{ steps.cfg.outputs.trivy }}
            BUSYBOX_VERSION=${{ steps.cfg.outputs.busybox }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

      - name: Sign published image
        run: cosign sign --yes --key env://COSIGN_PRIVATE_KEY "${IMAGE}@${{
          steps.build.outputs.digest }}"
        env:
          IMAGE: ${{ steps.cfg.outputs.image }}
          COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
          COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}

      - name: Generate image digest attestation
        uses: actions/attest@v4
        with:
          subject-name: ${{ steps.cfg.outputs.image }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true

      - name: Record published digest
        run: |
          {
            echo "Published image: ${{ steps.cfg.outputs.image }}"
            echo "Published platforms: ${{ steps.cfg.outputs.platforms }}"
            echo "Published digest: ${{ steps.build.outputs.digest }}"
            echo "Published attestation: ${{ steps.cfg.outputs.image }}@${{ steps.build.outputs.digest }}"
          } >> "$GITHUB_STEP_SUMMARY"