vanillaos/.github/workflows/release.yml at main · pythoninthegrasses/vanillaos · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
name: Release

on:
  push:
    tags:
      - '*'
    paths:
      - '.github/workflows/**'
      - 'includes.container/**'
      - 'modules/**'
      - 'recipe.yml'
  workflow_dispatch:

env:
    REGISTRY_USER: ${{ github.actor }}
    REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}

jobs:
  verify-image:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Cache APT packages
      uses: actions/cache@v4
      with:
        path: |
          ~/.apt/archives
          ~/.apt/lists
        key: ${{ runner.os }}-apt-${{ hashFiles('**/package-lock.json') }}-libfyaml-utils
        restore-keys: |
          ${{ runner.os }}-apt-${{ hashFiles('**/package-lock.json') }}-
          ${{ runner.os }}-apt-

    - name: Install dependencies
      run: sudo apt-get install -y libfyaml-utils

    - name: Read base image name from recipe
      id: read_base_recipe
      run: |
        BASE_IMAGE="$(fy-filter -f recipe.yml /stages/-1/base)"
        echo The base image is $BASE_IMAGE
        if [ -z $BASE_IMAGE ]; then exit 1; fi
        echo "base_image=$BASE_IMAGE" >> "$GITHUB_OUTPUT"
        echo "BASE_IMAGE=$BASE_IMAGE" >> "$GITHUB_ENV"

    - name: Verify Base Image Integrity
      run: |
        gh attestation verify oci://ghcr.io/${{ env.BASE_IMAGE }} --owner Vanilla-OS
      env:
        GH_TOKEN: ${{ github.token }}

  release:
    runs-on: ubuntu-latest
    needs: verify-image
    permissions:
      contents: write     # Allow actions to create release
      attestations: write # To create and write attestations
      id-token: write     # Additional permissions for the persistence of the attestations

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: vanilla-os/vib-gh-action@v0.8.1
        with:
          recipe: 'recipe.yml'
          plugins: 'Vanilla-OS/vib-fsguard:v1.5.3'

      - uses: actions/upload-artifact@v4
        with:
          name: Containerfile
          path: Containerfile

      - name: Create Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh release create "${{ github.ref_name }}" --generate-notes Containerfile

      - name: Attest Release Files
        id: attest
        uses: actions/attest-build-provenance@v1
        with:
          subject-path: 'Containerfile'