Skip to content

Commit bc00a10

Browse files
jpmcbjpmcb
authored
Merge pull request #47 from open-sauced/beta
chore: release 1.0.0
2 parents 80d7f88 + 1365a75 commit bc00a10

File tree

2 files changed

+158
-115
lines changed

2 files changed

+158
-115
lines changed

‎.github/workflows/build-image.yaml‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
name: Release pizza image
2+
3+
on:
4+
push:
5+
tags:
6+
- 'v*'
7+
8+
permissions:
9+
actions: read
10+
packages: write # for publish to ghcr.io
11+
id-token: write # for signing image
12+
13+
jobs:
14+
build:
15+
name: "📥 Build and publish image"
16+
runs-on: ubuntu-latest
17+
env:
18+
IMAGE_URI: ghcr.io/${{ github.repository }}
19+
IMAGE_URI_TAG: ghcr.io/${{ github.repository }}:${{ github.ref_name }}
20+
outputs:
21+
image: ${{ env.IMAGE_URI }}
22+
digest: ${{ steps.image_digest.outputs.IMAGE_DIGEST }}
23+
steps:
24+
- name: "☁️ Checkout code"
25+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # tag=v3
26+
- name: Set up Docker Buildx
27+
uses: docker/setup-buildx-action@v1
28+
- name: Login to GitHub Container Registry
29+
uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
30+
with:
31+
registry: ghcr.io
32+
username: ${{ github.actor }}
33+
password: ${{ secrets.GITHUB_TOKEN }}
34+
35+
- name: "🔀 Cross build"
36+
run: |
37+
#!/usr/bin/env bash
38+
39+
docker buildx bake \
40+
-f ./docker-bake.hcl \
41+
--set build.args.GO_LDFLAGS="$GO_LDFLAGS" \
42+
--set cross.tags=ghcr.io/${{ github.repository }}:${{ github.ref_name }} \
43+
--push \
44+
cross
45+
46+
- name: "🏗️ Install crane"
47+
if: startsWith(github.ref, 'refs/tags/')
48+
uses: imjasonh/setup-crane@00c9e93efa4e1138c9a7a5c594acd6c75a2fbf0c # v0.3
49+
50+
- name: "📸 Output image digest"
51+
if: startsWith(github.ref, 'refs/tags/')
52+
id: image_digest
53+
run: echo "IMAGE_DIGEST=$(crane digest ${IMAGE_URI_TAG})" >> $GITHUB_OUTPUT
54+
55+
sign:
56+
name: "📝 Sign image and generate sbom"
57+
runs-on: ubuntu-latest
58+
needs: [build]
59+
if: startsWith(github.ref, 'refs/tags/')
60+
steps:
61+
- name: "☁️ Checkout code"
62+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # tag=v3
63+
- name: Login to GitHub Container Registry
64+
uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
65+
with:
66+
registry: ghcr.io
67+
username: ${{ github.actor }}
68+
password: ${{ secrets.GITHUB_TOKEN }}
69+
70+
- name: "👀 Run Trivy in fs mode to generate SBOM"
71+
uses: aquasecurity/trivy-action@e5f43133f6e8736992c9f3c1b3296e24b37e17f2 # master
72+
with:
73+
scan-type: 'fs'
74+
format: 'spdx-json'
75+
output: 'spdx.sbom.json'
76+
77+
- name: "🤝 Install cosign"
78+
uses: sigstore/cosign-installer@dd6b2e2b610a11fd73dd187a43d57cc1394e35f9 # main
79+
80+
- name: "📝 Sign image and sbom"
81+
run: |
82+
#!/usr/bin/env bash
83+
set -euo pipefail
84+
cosign sign -a git_sha=$GITHUB_SHA ${IMAGE_URI_DIGEST} --yes
85+
cosign attach sbom --sbom spdx.sbom.json ${IMAGE_URI_DIGEST}
86+
cosign sign -a git_sha=$GITHUB_SHA --attachment sbom ${IMAGE_URI_DIGEST} --yes
87+
shell: bash
88+
env:
89+
IMAGE_URI_DIGEST: ${{ needs.build.outputs.image }}@${{ needs.build.outputs.digest }}
90+
91+
provenance:
92+
name: "🚨 SLSA provenance"
93+
needs: [build]
94+
if: startsWith(github.ref, 'refs/tags/')
95+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.6.0
96+
with:
97+
image: ${{ needs.build.outputs.image }}
98+
digest: ${{ needs.build.outputs.digest }}
99+
registry-username: ${{ github.actor }}
100+
secrets:
101+
registry-password: ${{ secrets.GITHUB_TOKEN }}
102+
103+
verify:
104+
name: "🔨 Verify image and provenance"
105+
runs-on: ubuntu-latest
106+
needs: [build, sign, provenance]
107+
if: startsWith(github.ref, 'refs/tags/')
108+
steps:
109+
- name: "📦 Login to GitHub Container Registry"
110+
uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
111+
with:
112+
registry: ghcr.io
113+
username: ${{ github.actor }}
114+
password: ${{ secrets.GITHUB_TOKEN }}
115+
116+
- name: "🦙 Install cosign"
117+
uses: sigstore/cosign-installer@dd6b2e2b610a11fd73dd187a43d57cc1394e35f9 # main
118+
119+
- name: "💃 Install slsa-verifier"
120+
uses: slsa-framework/slsa-verifier/actions/installer@c9abffe4d2ab2ffa0b2ea9b2582b84164f390adc # v2.3.0
121+
122+
- name: "👷 Verify image and provenance"
123+
run: |
124+
#!/usr/bin/env bash
125+
set -euo pipefail
126+
cosign verify ${IMAGE_URI_DIGEST} \
127+
--certificate-oidc-issuer ${GITHUB_ACTIONS_OIDC_ISSUER} \
128+
--certificate-identity ${COSIGN_KEYLESS_SIGNING_CERT_SUBJECT}
129+
slsa-verifier verify-image \
130+
--source-uri github.com/${{ github.repository }} ${IMAGE_URI_DIGEST}
131+
shell: bash
132+
env:
133+
IMAGE_URI_DIGEST: ${{ needs.build.outputs.image }}@${{ needs.build.outputs.digest }}
134+
GITHUB_ACTIONS_OIDC_ISSUER: https://token.actions.githubusercontent.com
135+
COSIGN_KEYLESS_SIGNING_CERT_SUBJECT: https://github.com/${{ github.repository }}/.github/workflows/build-image.yaml@${{ github.ref }}

‎.github/workflows/release.yaml‎

Lines changed: 23 additions & 115 deletions
Original file line numberDiff line numberDiff line change
@@ -1,127 +1,35 @@
1-
name: Release pizza image
1+
name: Semantic release
22

33
on:
44
push:
5-
tags:
6-
- 'v*'
7-
8-
permissions:
9-
actions: read
10-
packages: write # for publish to ghcr.io
11-
id-token: write # for signing image
5+
branches:
6+
- main
7+
- beta
8+
workflow_dispatch:
129

1310
jobs:
14-
build:
15-
name: Build and publish image
11+
release:
12+
name: Semantic release
1613
runs-on: ubuntu-latest
17-
env:
18-
IMAGE_URI: ghcr.io/${{ github.repository }}
19-
IMAGE_URI_TAG: ghcr.io/${{ github.repository }}:${{ github.ref_name }}
20-
outputs:
21-
image: ${{ env.IMAGE_URI }}
22-
digest: ${{ steps.image_digest.outputs.IMAGE_DIGEST }}
14+
timeout-minutes: 10
2315
steps:
24-
- name: Checkout code
25-
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # tag=v3
26-
- name: Set up Docker Buildx
27-
uses: docker/setup-buildx-action@v1
28-
- name: Login to GitHub Container Registry
29-
uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
16+
- name: "🔐 Generate token"
17+
id: generate_token
18+
uses: tibdex/github-app-token@v1
3019
with:
31-
registry: ghcr.io
32-
username: ${{ github.actor }}
33-
password: ${{ secrets.GITHUB_TOKEN }}
34-
35-
- name: Cross build
36-
run: |
37-
#!/usr/bin/env bash
38-
39-
docker buildx bake \
40-
-f ./docker-bake.hcl \
41-
--set build.args.GO_LDFLAGS="$GO_LDFLAGS" \
42-
--set cross.tags=ghcr.io/${{ github.repository }}:${{ github.ref_name }} \
43-
--push \
44-
cross
45-
46-
- name: Install crane
47-
if: startsWith(github.ref, 'refs/tags/')
48-
uses: imjasonh/setup-crane@00c9e93efa4e1138c9a7a5c594acd6c75a2fbf0c # v0.3
49-
- name: Output image digest
50-
if: startsWith(github.ref, 'refs/tags/')
51-
id: image_digest
52-
run: echo "IMAGE_DIGEST=$(crane digest ${IMAGE_URI_TAG})" >> $GITHUB_OUTPUT
20+
app_id: ${{ secrets.OS_GITHUB_APP_ID }}
21+
private_key: ${{ secrets.OS_GITHUB_APP_PRIVATE_KEY }}
5322

54-
sign:
55-
name: Sign image and generate sbom
56-
runs-on: ubuntu-latest
57-
needs: [build]
58-
if: startsWith(github.ref, 'refs/tags/')
59-
steps:
60-
- name: Checkout code
61-
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # tag=v3
62-
- name: Login to GitHub Container Registry
63-
uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
64-
with:
65-
registry: ghcr.io
66-
username: ${{ github.actor }}
67-
password: ${{ secrets.GITHUB_TOKEN }}
68-
- name: Run Trivy in fs mode to generate SBOM
69-
uses: aquasecurity/trivy-action@e5f43133f6e8736992c9f3c1b3296e24b37e17f2 # master
23+
- name: "☁️ Checkout repository"
24+
uses: actions/checkout@v3
7025
with:
71-
scan-type: 'fs'
72-
format: 'spdx-json'
73-
output: 'spdx.sbom.json'
74-
- name: Install cosign
75-
uses: sigstore/cosign-installer@dd6b2e2b610a11fd73dd187a43d57cc1394e35f9 # main
76-
- name: Sign image and sbom
77-
run: |
78-
#!/usr/bin/env bash
79-
set -euo pipefail
80-
cosign sign -a git_sha=$GITHUB_SHA ${IMAGE_URI_DIGEST} --yes
81-
cosign attach sbom --sbom spdx.sbom.json ${IMAGE_URI_DIGEST}
82-
cosign sign -a git_sha=$GITHUB_SHA --attachment sbom ${IMAGE_URI_DIGEST} --yes
83-
shell: bash
84-
env:
85-
IMAGE_URI_DIGEST: ${{ needs.build.outputs.image }}@${{ needs.build.outputs.digest }}
86-
87-
provenance:
88-
needs: [build]
89-
if: startsWith(github.ref, 'refs/tags/')
90-
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.6.0
91-
with:
92-
image: ${{ needs.build.outputs.image }}
93-
digest: ${{ needs.build.outputs.digest }}
94-
registry-username: ${{ github.actor }}
95-
secrets:
96-
registry-password: ${{ secrets.GITHUB_TOKEN }}
26+
fetch-depth: 0
27+
token: ${{ steps.generate_token.outputs.token }}
9728

98-
verify:
99-
name: Verify image and provenance
100-
runs-on: ubuntu-latest
101-
needs: [build, sign, provenance]
102-
if: startsWith(github.ref, 'refs/tags/')
103-
steps:
104-
- name: Login to GitHub Container Registry
105-
uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
106-
with:
107-
registry: ghcr.io
108-
username: ${{ github.actor }}
109-
password: ${{ secrets.GITHUB_TOKEN }}
110-
- name: Install cosign
111-
uses: sigstore/cosign-installer@dd6b2e2b610a11fd73dd187a43d57cc1394e35f9 # main
112-
- name: Install slsa-verifier
113-
uses: slsa-framework/slsa-verifier/actions/installer@c9abffe4d2ab2ffa0b2ea9b2582b84164f390adc # v2.3.0
114-
- name: Verify image and provenance
115-
run: |
116-
#!/usr/bin/env bash
117-
set -euo pipefail
118-
cosign verify ${IMAGE_URI_DIGEST} \
119-
--certificate-oidc-issuer ${GITHUB_ACITONS_OIDC_ISSUER} \
120-
--certificate-identity ${COSIGN_KEYLESS_SIGNING_CERT_SUBJECT}
121-
slsa-verifier verify-image \
122-
--source-uri github.com/${{ github.repository }} ${IMAGE_URI_DIGEST}
123-
shell: bash
29+
- name: "🚀 Release tag"
30+
id: semantic-release
12431
env:
125-
IMAGE_URI_DIGEST: ${{ needs.build.outputs.image }}@${{ needs.build.outputs.digest }}
126-
GITHUB_ACITONS_OIDC_ISSUER: https://token.actions.githubusercontent.com
127-
COSIGN_KEYLESS_SIGNING_CERT_SUBJECT: https://github.com/${{ github.repository }}/.github/workflows/release.yaml@${{ github.ref }}
32+
GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
33+
SKIP_NPM_PUBLISH: true
34+
SKIP_DOCKER_PUBLISH: true
35+
uses: open-sauced/release@v2

0 commit comments

Comments
 (0)