Skip to content

Commit 6606e68

Browse files
jdolitskyjdolitsky
committed
Add examples and project logo
Signed-off-by: Josh Dolitsky <josh@dolit.ski>
1 parent 8ce97fc commit 6606e68

5 files changed

Lines changed: 202 additions & 49 deletions

File tree

‎README.md‎

Lines changed: 100 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# wolfi-act
22

3-
![](https://github.com/wolfi-dev/wolfi-act/assets/393494/661c31fc-762f-4b53-a64f-56b116e7ba41)
3+
![](./wolfi-act.jpg)
44

55
Dynamic GitHub Actions from [Wolfi](https://wolfi.dev/) packages
66

@@ -15,84 +15,135 @@ and runs your command inside of it.
1515
Pass in `packages` with a comma-separated list of packages available in
1616
Wolfi, along with a `command` you wish to run.
1717

18-
### Example: run a grype and trivy scan on an image
19-
2018
```yaml
2119
- uses: wolfi-dev/wolfi-act@main
2220
with:
23-
packages: grype,trivy
21+
packages: jq,cosign
2422
command: |
25-
grype cgr.dev/chainguard/nginx
26-
trivy image cgr.dev/chainguard/nginx
23+
jq --version
24+
cosign --version
2725
```
2826
29-
### Example: full image publish pipeline
27+
### Example: run a grype and trivy scan on an image
3028
31-
Here's a full Github Actions workflow example which does the following (source [here](./.github/workflows/build.yml)):
29+
Source: [grype-trivy-scan-example.yaml](./examples/grype-trivy-scan-example.yaml)
3230
33-
1. Installs tools: `curl`, `apko`, `cosign`, `crane`, `grype`, `trivy`
34-
2. Downloads an apko config file using `curl`
35-
3. Logs into GHCR using `crane`
36-
4. Publishes a container image using `apko`
37-
5. Signs the image using `cosign`
38-
6. Scans the image with `grype` and `trivy`
39-
7. Tags the image using `crane`
40-
8. Ensure that the tagged image runs using `docker`
31+
```yaml
32+
# .github/workflows/grype-trivy-scan-example.yaml
33+
on:
34+
push:
35+
branches:
36+
- main
37+
workflow_dispatch: {}
38+
jobs:
39+
wolfi-act:
40+
runs-on: ubuntu-latest
41+
permissions:
42+
contents: read
43+
packages: write
44+
id-token: write # needed for GitHub OIDC Token
45+
steps:
46+
- uses: actions/checkout@v3
47+
- uses: wolfi-dev/wolfi-act@main
48+
with:
49+
packages: curl,apko,cosign,crane
50+
command: |
51+
set -x
52+
grype cgr.dev/chainguard/nginx
53+
trivy image cgr.dev/chainguard/nginx
54+
```
55+
56+
### Example: build, push, sign, and tag an image
57+
58+
Source: [oci-image-push-sign-tag-example.yaml](./examples/oci-image-push-sign-tag-example.yaml)
4159
4260
```yaml
61+
# .github/workflows/oci-image-push-sign-tag-example.yaml
4362
on:
4463
push:
4564
branches:
4665
- main
4766
workflow_dispatch: {}
48-
env:
49-
IMAGE_REPO: ghcr.io/${{ github.repository }}/wolfi-act-test
50-
APKO_CONFIG: https://raw.githubusercontent.com/chainguard-images/images/main/images/maven/configs/openjdk-17.apko.yaml
51-
GHCR_USER: ${{ github.repository_owner }}
52-
GHCR_PASS: ${{ github.token }}
5367
jobs:
54-
build:
68+
wolfi-act:
5569
runs-on: ubuntu-latest
5670
permissions:
5771
contents: read
5872
packages: write
59-
id-token: write # needed for GitHub OIDC Token
73+
id-token: write # needed for GitHub OIDC Token
6074
steps:
61-
- name: Build, sign, inspect an image using wolfi-act
62-
uses: wolfi-dev/wolfi-act@main
75+
- uses: actions/checkout@v3
76+
- uses: wolfi-dev/wolfi-act@main
77+
env:
78+
OCI_HOST: ghcr.io
79+
OCI_REPO: ${{ github.repository }}/wolfi-act-demo
80+
OCI_USER: ${{ github.repository_owner }}
81+
OCI_PASS: ${{ github.token }}
82+
OCI_TAG: latest
83+
APKO_ARCHS: x86_64,aarch64
84+
APKO_KEYS: https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
85+
APKO_REPOS: https://packages.wolfi.dev/os
86+
APKO_DEFAULT_CONF: https://raw.githubusercontent.com/chainguard-images/images/main/images/wolfi-base/configs/latest.apko.yaml
6387
with:
64-
packages: curl,apko,cosign,crane,grype,trivy
88+
packages: curl,apko,cosign,crane
6589
command: |
6690
set -x
6791
68-
# Download an apko config file
69-
curl -L -o apko.yaml "${APKO_CONFIG}"
92+
# Make sure repo has an apko.yaml file, otherwise use default
93+
if [[ ! -f apko.yaml ]]; then
94+
echo "Warning: no apko.yaml in repo, downloading from $APKO_DEFAULT_CONF"
95+
curl -sL -o apko.yaml $APKO_DEFAULT_CONF
96+
fi
97+
98+
# Login to OCI registry
99+
apko login $OCI_HOST -u $OCI_USER -p $OCI_PASS
70100
71-
# Login to GHCR
72-
crane auth login ghcr.io -u "${GHCR_USER}" -p "${GHCR_PASS}"
101+
# Publish image with apko and capture the index digest
102+
digest=$(apko publish --arch $APKO_ARCHS \
103+
-k $APKO_KEYS -r $APKO_REPOS \
104+
apko.yaml $OCI_HOST/$OCI_REPO)
73105
74-
# Publish image using apko
75-
apko publish apko.yaml "${IMAGE_REPO}" \
76-
--repository-append=https://packages.wolfi.dev/os \
77-
--keyring-append=https://packages.wolfi.dev/os/wolfi-signing.rsa.pub \
78-
--package-append=wolfi-baselayout \
79-
--arch=x86_64,aarch64 \
80-
--image-refs=apko.images.txt | tee apko.index.txt
81-
index_digest="$(cat apko.index.txt)"
106+
# Sign with cosign
107+
cosign sign --yes $digest
108+
109+
# Lastly, tag the image with crane
110+
crane copy $digest $OCI_HOST/$OCI_REPO:$OCI_TAG
111+
```
82112
83-
# Sign image with cosign
84-
cosign sign --yes $(cat apko.images.txt)
85113
86-
# Scan image with grype and trivy
87-
grype "${index_digest}"
88-
trivy image "${index_digest}"
114+
### Example: run multiple versions of kubectl using build matrix
89115
90-
# Tag image using crane
91-
crane cp "${index_digest}" "${IMAGE_REPO}:latest"
116+
Source: [multiple-versions-of-kubectl-example.yaml](./examples/multiple-versions-of-kubectl-example.yaml)
117+
118+
```yaml
119+
# .github/workflows/multiple-versions-of-kubectl-example.yaml
120+
on:
121+
push:
122+
branches:
123+
- main
124+
workflow_dispatch: {}
125+
jobs:
126+
wolfi-act:
127+
runs-on: ubuntu-latest
128+
strategy:
129+
matrix:
130+
wolfi_pkg_name_kubectl:
131+
- kubectl-1.24
132+
- kubectl-1.25
133+
- kubectl-1.26
134+
- kubectl # note: this is 1.27 or latest
135+
steps:
136+
- uses: actions/checkout@v3
137+
- uses: wolfi-dev/wolfi-act@main
138+
with:
139+
packages: ${{ matrix.wolfi_pkg_name_kubectl }}
140+
command: |
141+
set -x
92142
93-
- name: Make sure the image runs
94-
run: |
95-
set -x
96-
docker run --rm "${IMAGE_REPO}:latest" --version
143+
# Make a symlink when "kubectl" is not the name of the binary in the package
144+
if [[ "${{ matrix.wolfi_pkg_name_kubectl }}" != "kubectl" ]]; then
145+
ln -sf /usr/bin/${{ matrix.wolfi_pkg_name_kubectl }} /usr/bin/kubectl
146+
fi
97147
148+
kubectl version --client
98149
```

‎examples/grype-trivy-scan-example.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# .github/workflows/grype-trivy-scan-example.yaml
2+
on:
3+
push:
4+
branches:
5+
- main
6+
workflow_dispatch: {}
7+
jobs:
8+
wolfi-act:
9+
runs-on: ubuntu-latest
10+
permissions:
11+
contents: read
12+
packages: write
13+
id-token: write # needed for GitHub OIDC Token
14+
steps:
15+
- uses: actions/checkout@v3
16+
- uses: wolfi-dev/wolfi-act@main
17+
with:
18+
packages: curl,apko,cosign,crane
19+
command: |
20+
set -x
21+
grype cgr.dev/chainguard/nginx
22+
trivy image cgr.dev/chainguard/nginx

‎examples/multiple-versions-of-kubectl-example.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# .github/workflows/multiple-versions-of-kubectl-example.yaml
2+
on:
3+
push:
4+
branches:
5+
- main
6+
workflow_dispatch: {}
7+
jobs:
8+
wolfi-act:
9+
runs-on: ubuntu-latest
10+
strategy:
11+
matrix:
12+
wolfi_pkg_name_kubectl:
13+
- kubectl-1.24
14+
- kubectl-1.25
15+
- kubectl-1.26
16+
- kubectl # note: this is 1.27 or latest
17+
steps:
18+
- uses: actions/checkout@v3
19+
- uses: wolfi-dev/wolfi-act@main
20+
with:
21+
packages: ${{ matrix.wolfi_pkg_name_kubectl }}
22+
command: |
23+
set -x
24+
25+
# Make a symlink when "kubectl" is not the name of the binary in the package
26+
if [[ "${{ matrix.wolfi_pkg_name_kubectl }}" != "kubectl" ]]; then
27+
ln -sf /usr/bin/${{ matrix.wolfi_pkg_name_kubectl }} /usr/bin/kubectl
28+
fi
29+
30+
kubectl version --client

‎examples/oci-image-push-sign-tag-example.yaml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# .github/workflows/oci-image-push-sign-tag-example.yaml
2+
on:
3+
push:
4+
branches:
5+
- main
6+
workflow_dispatch: {}
7+
jobs:
8+
wolfi-act:
9+
runs-on: ubuntu-latest
10+
permissions:
11+
contents: read
12+
packages: write
13+
id-token: write # needed for GitHub OIDC Token
14+
steps:
15+
- uses: actions/checkout@v3
16+
- uses: wolfi-dev/wolfi-act@main
17+
env:
18+
OCI_HOST: ghcr.io
19+
OCI_REPO: ${{ github.repository }}/wolfi-act-demo
20+
OCI_USER: ${{ github.repository_owner }}
21+
OCI_PASS: ${{ github.token }}
22+
OCI_TAG: latest
23+
APKO_ARCHS: x86_64,aarch64
24+
APKO_KEYS: https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
25+
APKO_REPOS: https://packages.wolfi.dev/os
26+
APKO_DEFAULT_CONF: https://raw.githubusercontent.com/chainguard-images/images/main/images/wolfi-base/configs/latest.apko.yaml
27+
with:
28+
packages: curl,apko,cosign,crane
29+
command: |
30+
set -x
31+
32+
# Make sure repo has an apko.yaml file, otherwise use default
33+
if [[ ! -f apko.yaml ]]; then
34+
echo "Warning: no apko.yaml in repo, downloading from $APKO_DEFAULT_CONF"
35+
curl -sL -o apko.yaml $APKO_DEFAULT_CONF
36+
fi
37+
38+
# Login to OCI registry
39+
apko login $OCI_HOST -u $OCI_USER -p $OCI_PASS
40+
41+
# Publish image with apko and capture the index digest
42+
digest=$(apko publish --arch $APKO_ARCHS \
43+
-k $APKO_KEYS -r $APKO_REPOS \
44+
apko.yaml $OCI_HOST/$OCI_REPO)
45+
46+
# Sign with cosign
47+
cosign sign --yes $digest
48+
49+
# Lastly, tag the image with crane
50+
crane copy $digest $OCI_HOST/$OCI_REPO:$OCI_TAG

‎wolfi-act.jpg‎

73.2 KB
Loading

0 commit comments

Comments
 (0)