Merge pull request #136 from philips-software/Feature/34_RemaveDockerVariables

Add deprecation warnings: Feature/34 remave docker variables

Author: JeroenKnoops

CHANGELOG.md

@@ -6,8 +6,16 @@ and this project uses the version of main tool as main version number .
 
 ## [Unreleased]
 
+- Rename arguments to reflect multiple container registries.
+
+### DEPRECATION
+
+- `DOCKER_USERNAME`, `DOCKER_PASSWORD`, and `DOCKER_REGISTRY` are deprecated. Please use `REGISTRY_USERNAME`, `REGISTRY_TOKEN`, and `REGISTRY_URL`.
+
+## v4.4.0
 - [#50] - Fix: Automatic push of README to docker hub is broken.
 - [#48] - Loop through entire array of push-branches
+- [#34] - ** BREAKING ** Rename variables DOCKER_USERNAME, DOCKER_PASSWORD and DOCKER_REGISTRY
 
 ## v3.1.0 - 2020-09-23
 - Allow users to specify multiple branches to push to the artifact repository. `push-branches`
@@ -21,7 +29,7 @@ and this project uses the version of main tool as main version number .
 - Allow users to specify specific dockerfile instead of path
 
 The `docker build` command is now being called from the root of the project
-instead of the directory. 
+instead of the directory.
 
 This has impact when your project has:
 - Directories with multiple dockerfiles
@@ -30,15 +38,15 @@ This has impact when your project has:
 You now need to change the path to include the directory.
 
 Example:
-- `ADD /scripts/entrypoint.sh entrypoint.sh` becomes: `ADD /6/java/scripts/entrypoint.sh entrypoint` 
+- `ADD /scripts/entrypoint.sh entrypoint.sh` becomes: `ADD /6/java/scripts/entrypoint.sh entrypoint`
 
 ## v2.2.1 - 2020-05-18
 ### Changed
-- [#38] - Auto update readme was not working anymore 
+- [#38] - Auto update readme was not working anymore
 
 ## v2.2.0
 - [#33] - DOCKER_ORGANIZATION is optional when other repository store is used.
-- [#32] - DOCKER_REGISTRY should be an environment variable. 
+- [#32] - DOCKER_REGISTRY should be an environment variable.
 - Fix shellinter
 
 ### Add

LICENSE.md

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2020 Philips Software
+Copyright (c) 2020 - 2022 Philips Software
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -71,15 +71,15 @@ Builds docker images and publish them on request
 
 These variables can be set in the github repository secret vault.
 
-### `DOCKER_USERNAME`
+### `REGISTRY_USERNAME`
 
-**Required** Docker username
+**Required** Registry username
 
-### `DOCKER_PASSWORD`
+### `REGISTRY_TOKEN`
 
-**Required** Docker password
+**Required** Registry token
 
-### `DOCKER_REGISTRY`
+### `REGISTRY_URL`
 
 **Optional** Registry to push the docker image to. Defaults to Docker hub.
 
@@ -158,8 +158,8 @@ This action is a `docker` action.
     image-name: "node"
     tags: "latest 12 12.1 12.1.4"
   env:
-    DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-    DOCKER_PASSWORD: "${{ secrets.DOCKER_PASSWORD }}"
+    REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+    REGISTRY_TOKEN: "${{ secrets.REGISTRY_TOKEN }}"
     DOCKER_ORGANIZATION: myDockerOrganization
 ```
 
@@ -172,8 +172,8 @@ This action is a `docker` action.
     image-name: "node"
     tags: "latest 12 12.1 12.1.4"
   env:
-    DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-    DOCKER_PASSWORD: "${{ secrets.DOCKER_PASSWORD }}"
+    REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+    REGISTRY_TOKEN: "${{ secrets.REGISTRY_TOKEN }}"
     DOCKER_ORGANIZATION: myDockerOrganization
     FOO_BUILD_ARG: "foo"
     BAR_BUILD_ARG: ${{ secrets.SECRET_BAR_BUILD_ARG }}
@@ -191,9 +191,9 @@ This action is a `docker` action.
     tags: latest 0.1
     push-branches: main develop
   env:
-    DOCKER_USERNAME: ${{ github.actor }}
-    DOCKER_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-    DOCKER_REGISTRY: ghcr.io/organization-here
+    REGISTRY_USERNAME: ${{ github.actor }}
+    REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    REGISTRY_URL: ghcr.io/organization-here
     GITHUB_ORGANIZATION: organization-here
 ```
 
@@ -220,9 +220,9 @@ Store the content of `cosign.pub`, `cosign.key` and the password in GitHub Secre
     push-branches: main develop
     sign: true
   env:
-    DOCKER_USERNAME: ${{ github.actor }}
-    DOCKER_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-    DOCKER_REGISTRY: ghcr.io/organization-here
+    REGISTRY_USERNAME: ${{ github.actor }}
+    REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    REGISTRY_URL: ghcr.io/organization-here
     GITHUB_ORGANIZATION: organization-here
     COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
     COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
@@ -250,9 +250,9 @@ You will get a result when the image is valid.
     push-branches: main develop
     slsa-provenance: true
   env:
-    DOCKER_USERNAME: ${{ github.actor }}
-    DOCKER_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-    DOCKER_REGISTRY: ghcr.io/organization-here
+    REGISTRY_USERNAME: ${{ github.actor }}
+    REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    REGISTRY_URL: ghcr.io/organization-here
     GITHUB_ORGANIZATION: organization-here
 - name: Show provenance
   run: |
@@ -275,9 +275,9 @@ the COSIGN environment variables. (see #sign how to generate the key-pair)
     slsa-provenance: true
     sign: true
   env:
-    DOCKER_USERNAME: ${{ github.actor }}
-    DOCKER_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-    DOCKER_REGISTRY: ghcr.io/organization-here
+    REGISTRY_USERNAME: ${{ github.actor }}
+    REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    REGISTRY_URL: ghcr.io/organization-here
     GITHUB_ORGANIZATION: organization-here
     COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
     COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
@@ -306,9 +306,9 @@ You can inspect the provenance and decide on whether you want use the image.
     push-branches: main develop
     sbom: true
   env:
-    DOCKER_USERNAME: ${{ github.actor }}
-    DOCKER_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-    DOCKER_REGISTRY: ghcr.io/organization-here
+    REGISTRY_USERNAME: ${{ github.actor }}
+    REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    REGISTRY_URL: ghcr.io/organization-here
     GITHUB_ORGANIZATION: organization-here
 - name: Show SBOM
   run: |
@@ -331,9 +331,9 @@ the COSIGN environment variables. (see #sign how to generate the key-pair)
     sbom: true
     sign: true
   env:
-    DOCKER_USERNAME: ${{ github.actor }}
-    DOCKER_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-    DOCKER_REGISTRY: ghcr.io/organization-here
+    REGISTRY_USERNAME: ${{ github.actor }}
+    REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    REGISTRY_URL: ghcr.io/organization-here
     GITHUB_ORGANIZATION: organization-here
     COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
     COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
@@ -363,9 +363,9 @@ the COSIGN environment variables. (see #sign how to generate the key-pair)
     sign: true
     slsa-provenance: true
   env:
-    DOCKER_USERNAME: ${{ github.actor }}
-    DOCKER_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
-    DOCKER_REGISTRY: ghcr.io/organization-here
+    REGISTRY_USERNAME: ${{ github.actor }}
+    REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    REGISTRY_URL: ghcr.io/organization-here
     GITHUB_ORGANIZATION: organization-here
     COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
     COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
@@ -413,8 +413,8 @@ This can be done with a small snippet:
     tags: "latest ${{ env.major }} ${{ env.minor }} ${{ env.patch }}"
     push-on-git-tag: "true"
   env:
-    DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-    DOCKER_PASSWORD: "${{ secrets.DOCKER_PASSWORD }}"
+    REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+    REGISTRY_TOKEN: "${{ secrets.REGISTRY_TOKEN }}"
     DOCKER_ORGANIZATION: myDockerOrganization
 ```
 

container_digest.sh

@@ -5,19 +5,19 @@ set -e
 # shellcheck disable=SC2153
 docker_organization=$DOCKER_ORGANIZATION
 
-if [ -z "$DOCKER_REGISTRY" ]; then
+if [ -z "$REGISTRY_URL" ]; then
   if [ -z "$docker_organization" ]; then
     echo "::error::No DOCKER_ORGANIZATION set. This is mandatory when using docker.io"
     exit 1
   fi
-  DOCKER_REGISTRY="docker.io"
-  docker_registry_prefix="$DOCKER_REGISTRY/$docker_organization"
+  REGISTRY_URL="docker.io"
+  registry_url_prefix="$REGISTRY_URL/$docker_organization"
   echo "Docker organization: $docker_organization"
 else
-  docker_registry_prefix="$DOCKER_REGISTRY"
+  registry_url_prefix="$REGISTRY_URL"
 fi
 
-echo "docker_registry_prefix: $docker_registry_prefix"
+echo "registry_url_prefix: $registry_url_prefix"
 
 # builddir=$1
 shift
@@ -30,31 +30,31 @@ IFS=' '
 read -ra tags <<<"$alltags"
 basetag=${tags[0]}
 
-if [ -z "$DOCKER_PASSWORD" ]; then
-  echo "::error::No DOCKER_PASSWORD set. Please provide"
+if [ -z "$REGISTRY_TOKEN" ]; then
+  echo "::error::No REGISTRY_TOKEN set. Please provide"
   exit 1
 fi
 
-if [ -z "$DOCKER_USERNAME" ]; then
-  echo "::error::No DOCKER_USERNAME set. Please provide"
+if [ -z "$REGISTRY_USERNAME" ]; then
+  echo "::error::No REGISTRY_USERNAME set. Please provide"
   exit 1
 fi
 
 echo "Login to docker"
 echo "--------------------------------------------------------------------------------------------"
-echo "$DOCKER_PASSWORD" | docker login "$DOCKER_REGISTRY" -u "$DOCKER_USERNAME" --password-stdin
+echo "$REGISTRY_TOKEN" | docker login "$REGISTRY_URL" -u "$REGISTRY_USERNAME" --password-stdin
 
-docker pull "$docker_registry_prefix"/"$imagename":"$basetag"
+docker pull "$registry_url_prefix"/"$imagename":"$basetag"
 
-echo "Getting digest for $docker_registry_prefix/$imagename:$basetag"
-containerdigest=$(docker inspect "$docker_registry_prefix"/"$imagename":"$basetag" --format '{{ index .RepoDigests 0 }}' | cut -d '@' -f 2)
+echo "Getting digest for $registry_url_prefix/$imagename:$basetag"
+containerdigest=$(docker inspect "$registry_url_prefix"/"$imagename":"$basetag" --format '{{ index .RepoDigests 0 }}' | cut -d '@' -f 2)
 echo "found: ${containerdigest}"
 echo "::set-output name=container-digest::${containerdigest}"
 
 echo "--------------------------------------------------------------------------------------------"
 
 echo "Getting tags"
-containertags=$(docker inspect "$docker_registry_prefix"/"$imagename":"$basetag" --format '{{ join .RepoTags "\n" }}' | sed 's/.*://' | paste -s -d ',' -)
+containertags=$(docker inspect "$registry_url_prefix"/"$imagename":"$basetag" --format '{{ join .RepoTags "\n" }}' | sed 's/.*://' | paste -s -d ',' -)
 echo "found: ${containertags}"
 echo "::set-output name=container-tags::${containertags}"
 
@@ -76,15 +76,15 @@ then
   echo "${COSIGN_PUBLIC_KEY}" > "$COSIGN_PUB"
 
   echo "Sign image"
-  cosign sign --key "$COSIGN_KEY" "$docker_registry_prefix"/"$imagename"@"${containerdigest}"
+  cosign sign --key "$COSIGN_KEY" "$registry_url_prefix"/"$imagename"@"${containerdigest}"
 
   echo "Verify signing"
-  cosign verify --key "$COSIGN_PUB" "$docker_registry_prefix"/"$imagename"@"${containerdigest}" 
+  cosign verify --key "$COSIGN_PUB" "$registry_url_prefix"/"$imagename"@"${containerdigest}" 
 
   {
     echo 'Image is signed. You can verify it with the following command:'
     echo '```bash'
-    echo "cosign verify --key cosign.pub $docker_registry_prefix/$imagename@${containerdigest}"
+    echo "cosign verify --key cosign.pub $registry_url_prefix/$imagename@${containerdigest}"
     echo '```'
   } >> "$GITHUB_STEP_SUMMARY"
 fi
@@ -100,7 +100,7 @@ then
   slsa-provenance generate container \
     --github-context "$encoded_github" \
     --runner-context "$encoded_runner" \
-    --repository "$docker_registry_prefix"/"$imagename" \
+    --repository "$registry_url_prefix"/"$imagename" \
     --digest "${containerdigest}" \
     --tags "${containertags}"
 
@@ -121,12 +121,12 @@ then
     jq .predicate < provenance.json > provenance-predicate.json
 
     echo "Attest predicate"
-    cosign attest --predicate provenance-predicate.json --key "$COSIGN_KEY" --type slsaprovenance "$docker_registry_prefix"/"$imagename"@"${containerdigest}"
+    cosign attest --predicate provenance-predicate.json --key "$COSIGN_KEY" --type slsaprovenance "$registry_url_prefix"/"$imagename"@"${containerdigest}"
 
     {
       echo "SLSA Provenance file is attested. You can verify it with the following command."
       echo '```bash'
-      echo "cosign verify-attestation --key cosign.pub $docker_registry_prefix/$imagename@${containerdigest} | jq '.payload |= @base64d | .payload | fromjson | select(.predicateType==\"https://slsa.dev/provenance/v0.2\" ) | .'"
+      echo "cosign verify-attestation --key cosign.pub $registry_url_prefix/$imagename@${containerdigest} | jq '.payload |= @base64d | .payload | fromjson | select(.predicateType==\"https://slsa.dev/provenance/v0.2\" ) | .'"
       echo '```'
     } >> "$GITHUB_STEP_SUMMARY"
   fi
@@ -137,7 +137,7 @@ then
   echo "### SBOM" >> "$GITHUB_STEP_SUMMARY"
   echo "Using Syft to generate SBOM"
 
-  syft packages "$docker_registry_prefix"/"$imagename"@"${containerdigest}" -o spdx-json=sbom-spdx-formatted.json
+  syft packages "$registry_url_prefix"/"$imagename"@"${containerdigest}" -o spdx-json=sbom-spdx-formatted.json
 
   echo "Remove formatting"
   jq -c . sbom-spdx-formatted.json > sbom-spdx.json
@@ -153,14 +153,14 @@ then
     echo "Attaching SBOM  with Cosign"
 
     echo "Attest SBOM"
-    cosign attest --predicate sbom-spdx.json --type spdx --key "$COSIGN_KEY" "$docker_registry_prefix"/"$imagename"@"${containerdigest}"
+    cosign attest --predicate sbom-spdx.json --type spdx --key "$COSIGN_KEY" "$registry_url_prefix"/"$imagename"@"${containerdigest}"
 
     echo "Done attesting the SBOM"
 
     {
       echo "SBOM file is attested. You can verify it with the following command."
       echo '```bash'
-      echo "cosign verify-attestation --key cosign.pub $docker_registry_prefix/$imagename@${containerdigest} | jq '.payload |= @base64d | .payload | fromjson | select( .predicateType==\"https://spdx.dev/Document\" ) | .predicate.Data | fromjson | .'" 
+      echo "cosign verify-attestation --key cosign.pub $registry_url_prefix/$imagename@${containerdigest} | jq '.payload |= @base64d | .payload | fromjson | select( .predicateType==\"https://spdx.dev/Document\" ) | .predicate.Data | fromjson | .'" 
       echo '```'
     } >> "$GITHUB_STEP_SUMMARY"
 

docker_build.sh

@@ -22,18 +22,18 @@ echo "--------------------------------------------------------------------------
 # shellcheck disable=SC2153
 docker_organization=$DOCKER_ORGANIZATION
 
-if [ -z "$DOCKER_REGISTRY" ]; then
+if [ -z "$REGISTRY_URL" ]; then
   if [ -z "$docker_organization" ]; then
     echo "  No DOCKER_ORGANIZATION set. This is mandatory when using docker.io"
     exit 1
   fi
-  docker_registry_prefix="docker.io/$docker_organization"
+  registry_url_prefix="docker.io/$docker_organization"
   echo "Docker organization: $docker_organization"
 else
-  docker_registry_prefix="$DOCKER_REGISTRY"
+  registry_url_prefix="$REGISTRY_URL"
 fi
 
-echo "docker_registry_prefix: $docker_registry_prefix"
+echo "registry_url_prefix: $registry_url_prefix"
 
 # Checking GITHUB_ORGANIZATION environment variable
 
@@ -92,12 +92,12 @@ echo "repo: https://github.com/$project/tree/$commitsha"
 echo "https://github.com/$project/tree/$commitsha" >REPO
 
 # shellcheck disable=SC2086
-docker build . -f "$dockerfilepath" -t "$docker_registry_prefix"/"$imagename":"$basetag" $docker_build_args
+docker build . -f "$dockerfilepath" -t "$registry_url_prefix"/"$imagename":"$basetag" $docker_build_args
 
 echo "--------------------------------------------------------------------------------------------"
 for tag in "${tags[@]:1}"; do
-  echo "Tagging $docker_registry_prefix/$imagename:$basetag as $docker_registry_prefix/$imagename:$tag"
-  docker tag "$docker_registry_prefix"/"$imagename":"$basetag" "$docker_registry_prefix"/"$imagename":"$tag"
+  echo "Tagging $registry_url_prefix/$imagename:$basetag as $registry_url_prefix/$imagename:$tag"
+  docker tag "$registry_url_prefix"/"$imagename":"$basetag" "$registry_url_prefix"/"$imagename":"$tag"
 done
 echo "============================================================================================"
 echo "Finished building docker images from: $dockerfilepath"