cryptpilot/.github/workflows/build-docker.yml at master · openanolis/cryptpilot · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
name: Build Docker Images

on:
  push:
    branches:
      - 'master'
      - 'main'
    tags:
      - 'v*.*.*'
  pull_request:
    branches:
      - 'master'
      - 'main'

jobs:
  build-and-push:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Docker Setup Buildx
        id: buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver: docker-container
          driver-opts: image=moby/buildkit:master,network=host

      - name: Docker meta (fde)
        id: meta-fde
        uses: docker/metadata-action@v5
        with:
          images: |
            ghcr.io/${{ github.repository_owner }}/cryptpilot-fde
          labels: |
            org.opencontainers.image.title=cryptpilot-fde
            org.opencontainers.image.description=Full-disk encryption tooling for system volumes
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,format=long
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Docker meta (crypt)
        id: meta-crypt
        uses: docker/metadata-action@v5
        with:
          images: |
            ghcr.io/${{ github.repository_owner }}/cryptpilot-crypt
          labels: |
            org.opencontainers.image.title=cryptpilot-crypt
            org.opencontainers.image.description=Data volume encryption tooling
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,format=long
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Docker meta (verity)
        id: meta-verity
        uses: docker/metadata-action@v5
        with:
          images: |
            ghcr.io/${{ github.repository_owner }}/cryptpilot-verity
          labels: |
            org.opencontainers.image.title=cryptpilot-verity
            org.opencontainers.image.description=Integrity measurement tool for directory trees
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha,format=long
            type=raw,value=latest,enable={{is_default_branch}}

      # Build all three images sequentially to maximize cache reuse
      # Builder stage is shared and cached across all three builds
      - name: Build cryptpilot-fde
        uses: docker/build-push-action@v6.9.0
        with:
          context: .
          file: Dockerfile.fde
          target: release-fde
          tags: |
            cryptpilot-fde:test
            ${{ steps.meta-fde.outputs.tags }}
          labels: ${{ steps.meta-fde.outputs.labels }}
          outputs: type=docker,dest=${{ runner.temp }}/cryptpilot-fde.tar
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Build cryptpilot-crypt
        uses: docker/build-push-action@v6.9.0
        with:
          context: .
          file: Dockerfile.crypt
          target: release-crypt
          tags: |
            cryptpilot-crypt:test
            ${{ steps.meta-crypt.outputs.tags }}
          labels: ${{ steps.meta-crypt.outputs.labels }}
          outputs: type=docker,dest=${{ runner.temp }}/cryptpilot-crypt.tar
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Build cryptpilot-verity
        uses: docker/build-push-action@v6.9.0
        with:
          context: .
          file: Dockerfile.verity
          target: release-verity
          tags: |
            cryptpilot-verity:test
            ${{ steps.meta-verity.outputs.tags }}
          labels: ${{ steps.meta-verity.outputs.labels }}
          outputs: type=docker,dest=${{ runner.temp }}/cryptpilot-verity.tar
          cache-from: type=gha
          cache-to: type=gha,mode=max

      # Test all images
      - name: Load and test cryptpilot-fde
        run: |
          docker load --input ${{ runner.temp }}/cryptpilot-fde.tar
          docker run --rm cryptpilot-fde:test cryptpilot-fde-host --version

      - name: Load and test cryptpilot-crypt
        run: |
          docker load --input ${{ runner.temp }}/cryptpilot-crypt.tar
          docker run --rm cryptpilot-crypt:test cryptpilot-crypt --version

      - name: Load and test cryptpilot-verity
        run: |
          docker load --input ${{ runner.temp }}/cryptpilot-verity.tar
          docker run --rm cryptpilot-verity:test cryptpilot-verity --version

      # Push images (only on tag or master/main branch)
      - name: Login to GHCR Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Push cryptpilot-fde
        env:
          IMAGE_TAGS: ${{ steps.meta-fde.outputs.tags }}
        run: |
          set -e
          set -x
          for tag in ${IMAGE_TAGS}; do
              docker tag cryptpilot-fde:test ${tag}
              docker push ${tag}
          done

      - name: Push cryptpilot-crypt
        env:
          IMAGE_TAGS: ${{ steps.meta-crypt.outputs.tags }}
        run: |
          set -e
          set -x
          for tag in ${IMAGE_TAGS}; do
              docker tag cryptpilot-crypt:test ${tag}
              docker push ${tag}
          done

      - name: Push cryptpilot-verity
        env:
          IMAGE_TAGS: ${{ steps.meta-verity.outputs.tags }}
        run: |
          set -e
          set -x
          for tag in ${IMAGE_TAGS}; do
              docker tag cryptpilot-verity:test ${tag}
              docker push ${tag}
          done