Skip to content

Commit 9b25f80

Browse files
hydazzhydazz
committed
chore: drop jenkins
1 parent 38f3051 commit 9b25f80

37 files changed

Lines changed: 1291 additions & 1880 deletions

‎.github/actions/bake-vars/action.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
# yaml-language-server: $schema=https://json.schemastore.org/github-action.json
3+
name: Bake Vars
4+
description: Reads app, platforms, and version from docker-bake.hcl
5+
6+
outputs:
7+
app:
8+
description: Container image name
9+
value: ${{ steps.opts.outputs.app }}
10+
platforms:
11+
description: Platforms array as JSON string
12+
value: ${{ steps.opts.outputs.platforms }}
13+
version:
14+
description: Upstream version
15+
value: ${{ steps.opts.outputs.version }}
16+
17+
runs:
18+
using: composite
19+
steps:
20+
- id: opts
21+
shell: bash
22+
run: |-
23+
BAKE=$(docker buildx bake image --print --progress=quiet)
24+
APP=$(jq --raw-output '.target.image.args.APP' <<<"$BAKE")
25+
PLATFORMS=$(jq --raw-output --compact-output '.target.image.platforms' <<<"$BAKE")
26+
VERSION=$(jq --raw-output '.target.image.args.VERSION' <<<"$BAKE" | sed 's/^v//')
27+
{
28+
echo "app=${APP}"
29+
echo "platforms=${PLATFORMS}"
30+
echo "version=${VERSION}"
31+
} >>"$GITHUB_OUTPUT"

‎.github/labeler.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
area/image:
3+
- changed-files:
4+
- any-glob-to-any-file:
5+
- Dockerfile
6+
- docker-bake.hcl
7+
- root/**/*
8+
area/github:
9+
- changed-files:
10+
- any-glob-to-any-file:
11+
- .github/**/*
12+
area/mise:
13+
- changed-files:
14+
- any-glob-to-any-file:
15+
- .mise.toml
16+
area/renovate:
17+
- changed-files:
18+
- any-glob-to-any-file:
19+
- .renovate/**/*
20+
- .renovaterc.json5
21+
area/tests:
22+
- changed-files:
23+
- any-glob-to-any-file:
24+
- go.mod
25+
- go.sum
26+
- tests/**/*

‎.github/labels.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
# Areas
3+
- name: area/image
4+
color: 0e8a16
5+
- name: area/github
6+
color: 0e8a16
7+
- name: area/mise
8+
color: 0e8a16
9+
- name: area/renovate
10+
color: 0e8a16
11+
- name: area/tests
12+
color: 0e8a16
13+
# Semantic Types
14+
- name: type/digest
15+
color: ffeC19
16+
- name: type/patch
17+
color: ffeC19
18+
- name: type/minor
19+
color: ff9800
20+
- name: type/major
21+
color: f6412d
22+
# Uncategorized
23+
- name: stale
24+
color: c5def5

‎.github/workflows/build.yaml‎

Lines changed: 245 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,245 @@
1+
---
2+
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
3+
name: Build
4+
5+
on:
6+
workflow_call:
7+
inputs:
8+
release:
9+
type: boolean
10+
description: Release
11+
required: true
12+
13+
jobs:
14+
plan:
15+
name: Plan
16+
runs-on: ubuntu-latest
17+
outputs:
18+
app: ${{ steps.opts.outputs.app }}
19+
platforms: ${{ steps.opts.outputs.platforms }}
20+
version: ${{ steps.opts.outputs.version }}
21+
steps:
22+
- name: Checkout
23+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
24+
with:
25+
persist-credentials: false
26+
27+
- name: Get Bake Vars
28+
uses: ./.github/actions/bake-vars
29+
id: opts
30+
31+
- name: Build Image Metadata
32+
uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
33+
id: meta
34+
env:
35+
DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
36+
with:
37+
images: ghcr.io/${{ github.repository_owner }}/${{ steps.opts.outputs.app }}
38+
flavor: latest=false
39+
tags: |
40+
type=raw,value=latest,enable=${{ inputs.release }}
41+
type=raw,value=${{ steps.opts.outputs.version }},enable=${{ inputs.release }}
42+
type=raw,value=sandbox,enable=${{ ! inputs.release }}
43+
44+
- name: Upload Bake Metadata
45+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
46+
with:
47+
name: bake-metadata
48+
path: ${{ steps.meta.outputs.bake-file }}
49+
if-no-files-found: error
50+
retention-days: 1
51+
52+
build:
53+
name: Build (${{ matrix.platform }})
54+
needs:
55+
- plan
56+
strategy:
57+
fail-fast: false
58+
matrix:
59+
platform: ${{ fromJson(needs.plan.outputs.platforms) }}
60+
runs-on: ${{ startsWith(matrix.platform, 'linux/arm') && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
61+
steps:
62+
- name: Checkout
63+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
64+
with:
65+
persist-credentials: false
66+
67+
- name: Get Target Architecture
68+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
69+
id: target
70+
with:
71+
script: |-
72+
core.setOutput('arch', '${{ matrix.platform }}'.split('/').pop());
73+
74+
- name: Login to GitHub Container Registry
75+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
76+
with:
77+
registry: ghcr.io
78+
username: ${{ github.actor }}
79+
password: ${{ github.token }}
80+
81+
- name: Download Bake Metadata
82+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
83+
with:
84+
name: bake-metadata
85+
path: ${{ runner.temp }}
86+
87+
- name: Setup Docker Buildx
88+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
89+
90+
- name: Build Image
91+
uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
92+
id: bake
93+
with:
94+
files: |
95+
./docker-bake.hcl
96+
cwd://${{ runner.temp }}/docker-metadata-action-bake.json
97+
targets: image
98+
provenance: false
99+
set: |
100+
*.platform=${{ matrix.platform }}
101+
*.cache-from=${{ format('type=registry,ref=ghcr.io/{0}/{1}-cache:{2}', github.repository_owner, needs.plan.outputs.app, steps.target.outputs.arch) }}
102+
*.cache-to=${{ inputs.release && format('type=registry,ref=ghcr.io/{0}/{1}-cache:{2},mode=max,compression=zstd,force-compression=true', github.repository_owner, needs.plan.outputs.app, steps.target.outputs.arch) || '' }}
103+
*.labels.org.opencontainers.image.title=${{ needs.plan.outputs.app }}
104+
*.labels.org.opencontainers.image.version=${{ needs.plan.outputs.version }}
105+
*.labels.org.opencontainers.image.revision=${{ github.sha }}
106+
*.labels.org.opencontainers.image.vendor=${{ github.repository_owner }}
107+
*.output=type=image,name=ghcr.io/${{ github.repository_owner }}/${{ needs.plan.outputs.app }},push-by-digest=true,name-canonical=true,push=true,compression=zstd,force-compression=true
108+
*.tags=
109+
110+
- name: Export Digest
111+
env:
112+
METADATA: ${{ steps.bake.outputs.metadata }}
113+
run: |-
114+
mkdir -p ${{ runner.temp }}/digests
115+
DIGEST=$(jq -r '.image["containerimage.digest"]' <<<"$METADATA")
116+
test -n "$DIGEST" || { echo "::error::bake metadata had no digest"; jq . <<<"$METADATA"; exit 1; }
117+
touch "${{ runner.temp }}/digests/${DIGEST#sha256:}"
118+
119+
- name: Upload Digest
120+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
121+
with:
122+
name: digests-${{ steps.target.outputs.arch }}
123+
path: ${{ runner.temp }}/digests/*
124+
if-no-files-found: error
125+
retention-days: 1
126+
127+
merge:
128+
name: Merge
129+
runs-on: ubuntu-latest
130+
needs:
131+
- plan
132+
- build
133+
outputs:
134+
digest: ${{ steps.digest.outputs.digest }}
135+
steps:
136+
- name: Download Bake Metadata
137+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
138+
with:
139+
name: bake-metadata
140+
path: ${{ runner.temp }}
141+
142+
- name: Download Digests
143+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
144+
with:
145+
path: ${{ runner.temp }}/digests
146+
pattern: digests-*
147+
merge-multiple: true
148+
149+
- name: Login to GitHub Container Registry
150+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
151+
with:
152+
registry: ghcr.io
153+
username: ${{ github.actor }}
154+
password: ${{ github.token }}
155+
156+
- name: Create Manifest List and Push
157+
working-directory: ${{ runner.temp }}/digests
158+
env:
159+
APP: ${{ needs.plan.outputs.app }}
160+
OWNER: ${{ github.repository_owner }}
161+
META: ${{ runner.temp }}/docker-metadata-action-bake.json
162+
run: |-
163+
docker buildx imagetools create \
164+
$(jq --raw-output --compact-output ".target.\"docker-metadata-action\".tags | map(select(startswith(\"ghcr.io/$OWNER/$APP\")) | \"-t \" + .) | join(\" \")" "$META") \
165+
$(printf "ghcr.io/$OWNER/$APP@sha256:%s " *)
166+
167+
- name: Inspect Image
168+
env:
169+
APP: ${{ needs.plan.outputs.app }}
170+
OWNER: ${{ github.repository_owner }}
171+
META: ${{ runner.temp }}/docker-metadata-action-bake.json
172+
run: |-
173+
TAG=$(jq --raw-output '.target."docker-metadata-action".args.DOCKER_META_VERSION' "$META")
174+
docker buildx imagetools inspect "ghcr.io/$OWNER/$APP:$TAG"
175+
176+
- name: Export Digest
177+
id: digest
178+
env:
179+
APP: ${{ needs.plan.outputs.app }}
180+
OWNER: ${{ github.repository_owner }}
181+
META: ${{ runner.temp }}/docker-metadata-action-bake.json
182+
run: |-
183+
TAG=$(jq --raw-output '.target."docker-metadata-action".args.DOCKER_META_VERSION' "$META")
184+
DIGEST=$(docker buildx imagetools inspect "ghcr.io/$OWNER/$APP:$TAG" --format '{{ json . }}' | jq --raw-output '.manifest.digest')
185+
echo "digest=$DIGEST" >>"$GITHUB_OUTPUT"
186+
187+
attest:
188+
name: Attest
189+
needs:
190+
- plan
191+
- merge
192+
runs-on: ubuntu-latest
193+
steps:
194+
- name: Login to GitHub Container Registry
195+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
196+
with:
197+
registry: ghcr.io
198+
username: ${{ github.actor }}
199+
password: ${{ github.token }}
200+
201+
- name: Upload Dependency Snapshot
202+
uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
203+
with:
204+
dependency-snapshot: true
205+
image: ghcr.io/${{ github.repository_owner }}/${{ needs.plan.outputs.app }}@${{ needs.merge.outputs.digest }}
206+
207+
- name: Attestation
208+
uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
209+
with:
210+
push-to-registry: false
211+
subject-name: ghcr.io/${{ github.repository_owner }}/${{ needs.plan.outputs.app }}
212+
subject-digest: ${{ needs.merge.outputs.digest }}
213+
214+
- name: Verify Attestation
215+
env:
216+
GITHUB_TOKEN: ${{ github.token }}
217+
run: |-
218+
gh attestation verify \
219+
--repo ${{ github.repository }} \
220+
oci://ghcr.io/${{ github.repository_owner }}/${{ needs.plan.outputs.app }}@${{ needs.merge.outputs.digest }}
221+
222+
test:
223+
if: ${{ ! inputs.release }}
224+
name: Test
225+
needs:
226+
- plan
227+
- merge
228+
- attest
229+
runs-on: ubuntu-latest
230+
steps:
231+
- name: Checkout
232+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
233+
with:
234+
persist-credentials: false
235+
236+
- name: Setup Go
237+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
238+
with:
239+
go-version-file: go.mod
240+
241+
- name: Run Tests
242+
env:
243+
TEST_IMAGE: ghcr.io/${{ github.repository_owner }}/${{ needs.plan.outputs.app }}@${{ needs.merge.outputs.digest }}
244+
run: |-
245+
go test -v -timeout 15m ./tests/...

‎.github/workflows/codeql.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
3+
name: CodeQL
4+
5+
on:
6+
schedule:
7+
- cron: 30 1 * * *
8+
workflow_dispatch:
9+
10+
permissions:
11+
contents: read
12+
13+
jobs:
14+
analyze:
15+
name: Analyze (${{ matrix.language }})
16+
runs-on: ubuntu-latest
17+
permissions:
18+
security-events: write
19+
packages: read
20+
actions: read
21+
contents: read
22+
strategy:
23+
fail-fast: false
24+
matrix:
25+
include:
26+
- language: actions
27+
build-mode: none
28+
source-root: .
29+
steps:
30+
- name: Checkout
31+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
32+
with:
33+
persist-credentials: false
34+
35+
- name: Initialize CodeQL
36+
uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
37+
with:
38+
languages: ${{ matrix.language }}
39+
build-mode: ${{ matrix.build-mode }}
40+
source-root: ${{ matrix.source-root }}
41+
42+
- name: Perform CodeQL Analysis
43+
uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
44+
with:
45+
category: language:${{ matrix.language }}

0 commit comments

Comments
 (0)