Skip to content

Commit 4ad8ab5

Browse files
reactive-firewallreactive-firewall
committed
[TEST] fixed the testing scripts and added docker template
1 parent 19a1607 commit 4ad8ab5

7 files changed

Lines changed: 524 additions & 34 deletions

File tree

‎.github/workflows/Build-FeatherHash.yaml‎

Lines changed: 260 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,260 @@
1+
---
2+
name: Build and Push Docker Image
3+
run-name: Build ${{ github.ref_name }}
4+
#
5+
# "Continuous Integration workflow for building, the project."
6+
#
7+
# Jobs included:
8+
# - build: building the image
9+
#
10+
# Required Secrets:
11+
# NONE
12+
13+
on: # yamllint disable-line rule:truthy
14+
push:
15+
branches: ["**"] # matches any branch
16+
tags: ["v*"]
17+
pull_request:
18+
branches: ["**"]
19+
20+
# Declare default permissions as none.
21+
permissions: {}
22+
23+
jobs:
24+
seed:
25+
permissions:
26+
actions: read
27+
contents: read
28+
packages: none
29+
pull-requests: read
30+
runs-on: ubuntu-latest
31+
outputs:
32+
timestamp: ${{ steps.output_time.outputs.bootstrap-timestamp }}
33+
feather-timestamp: ${{ steps.output_time.outputs.feather-timestamp }}
34+
steps:
35+
- name: Checkout code
36+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
37+
with:
38+
persist-credentials: false
39+
fetch-depth: 0
40+
submodules: false
41+
- id: output_time
42+
name: Get Git commit timestamps
43+
shell: bash
44+
run: |
45+
printf "%s\n" "::group::bootstrap-feather-env"
46+
printf "bootstrap-timestamp=%s\n" $(git log -1 --pretty=%ct) >> "$GITHUB_OUTPUT"
47+
printf "TIMESTAMP=%s\n" $(git log -1 --pretty=%ct) >> "$GITHUB_ENV"
48+
printf "feather-timestamp=%s %s\n" $(date -j -f "%s" "$(git log -1 --pretty=%ct)" "+%C%y-%d-%m %H:%M:%S") >> "$GITHUB_OUTPUT"
49+
printf "%s %s\n" "featherhash-shasum will be synced at time of:" $(date -j -f "%s" "$(git log -1 --pretty=%ct)" "+%C%y-%d-%m %H:%M:%S")
50+
printf "%s\n" "::endgroup::"
51+
52+
build:
53+
permissions:
54+
actions: read
55+
contents: read
56+
statuses: write
57+
packages: write
58+
pull-requests: read
59+
security-events: none
60+
runs-on: ubuntu-latest
61+
needs: seed
62+
strategy:
63+
matrix:
64+
architecture: [amd64, arm64, arm]
65+
66+
steps:
67+
- name: Checkout code
68+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
69+
with:
70+
persist-credentials: false
71+
fetch-depth: 0
72+
submodules: false
73+
74+
- name: Prepare
75+
run: |
76+
platform=linux/${{ matrix.architecture }}
77+
echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
78+
79+
- name: Set up QEMU for multi-architecture builds
80+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
81+
82+
- name: Set up Docker Buildx
83+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
84+
with:
85+
platforms: linux/${{ matrix.architecture }}
86+
cleanup: true
87+
88+
- name: Docker meta
89+
id: meta
90+
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
91+
with:
92+
context: git
93+
images: ghcr.io/reactive-firewall/featherhash-shasum
94+
tags: |
95+
type=ref,event=branch
96+
type=ref,event=pr
97+
type=semver,pattern={{version}}
98+
type=semver,pattern={{major}}.{{minor}}
99+
type=sha
100+
101+
- name: Log in to GitHub Container Registry
102+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
103+
with:
104+
registry: ghcr.io
105+
username: ${{ github.actor }}
106+
password: ${{ github.token }}
107+
logout: true
108+
109+
- name: Build and push Docker image
110+
id: build
111+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
112+
with:
113+
context: .
114+
file: dockerfile
115+
labels: ${{ steps.meta.outputs.labels }}
116+
tags: ghcr.io/reactive-firewall/featherhash-shasum
117+
platforms: linux/${{ matrix.architecture }}
118+
build-args: |
119+
TARGETARCH=${{ matrix.architecture }}
120+
cache-from: type=local,src=/tmp/.buildx-cache
121+
cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
122+
attests: |
123+
type=sbom
124+
type=provenance
125+
sbom: true
126+
provenance: mode=max
127+
push: true
128+
annotations: |
129+
index.org.opencontainers.image.title=featherhash-shasum
130+
index.org.opencontainers.image.authors=feather-maintainers@users.noreply.github.com
131+
index.org.opencontainers.image.description=Multi-arch FeatherHash SHA-Sum tools Build image
132+
index.org.opencontainers.image.vendor=individual
133+
index.org.opencontainers.image.licenses="0BSD"
134+
outputs: type=image,push-by-digest=true,name-canonical=true,push=true,annotation-index.org.opencontainers.image.description=Multi-arch FeatherHash build image ${{ matrix.architecture }}
135+
env:
136+
SOURCE_DATE_EPOCH: ${{ needs.seed.outputs.timestamp }}
137+
FEATHERHASH_DATE_EPOCH: ${{ needs.seed.outputs.feather-timestamp }}
138+
TARGETARCH: ${{ matrix.architecture }}
139+
- name: Export digest
140+
run: |
141+
mkdir -p ${{ runner.temp }}/digests
142+
digest="${{ steps.build.outputs.digest }}"
143+
touch "${{ runner.temp }}/digests/${digest#sha256:}"
144+
145+
- name: Logout from Docker Hub
146+
run: docker logout
147+
148+
- name: Upload digest
149+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
150+
with:
151+
name: digests-${{ env.PLATFORM_PAIR }}
152+
path: ${{ runner.temp }}/digests/*
153+
if-no-files-found: error
154+
retention-days: 1
155+
156+
merge:
157+
permissions:
158+
actions: read
159+
contents: read
160+
statuses: write
161+
packages: write
162+
pull-requests: read
163+
security-events: none
164+
runs-on: ubuntu-latest
165+
needs: build
166+
outputs:
167+
merge_version: ${{ steps.meta.outputs.version }}
168+
steps:
169+
- name: Checkout code
170+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
171+
with:
172+
persist-credentials: false
173+
fetch-depth: 0
174+
submodules: false
175+
176+
- name: Download digests
177+
uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
178+
with:
179+
path: ${{ runner.temp }}/digests
180+
pattern: digests-*
181+
merge-multiple: true
182+
183+
- name: Set up Docker Buildx
184+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
185+
186+
- name: Log in to GitHub Container Registry
187+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
188+
with:
189+
registry: ghcr.io
190+
username: ${{ github.actor }}
191+
password: ${{ github.token }}
192+
logout: true
193+
194+
- name: Docker meta
195+
id: meta
196+
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
197+
with:
198+
context: git
199+
images: ghcr.io/reactive-firewall/featherhash-shasum
200+
tags: |
201+
type=ref,event=branch
202+
type=ref,event=pr
203+
type=semver,pattern={{version}}
204+
type=semver,pattern={{major}}.{{minor}}
205+
type=sha
206+
env:
207+
SOURCE_DATE_EPOCH: ${{ needs.seed.outputs.timestamp }}
208+
209+
- name: Create manifest list and push
210+
working-directory: ${{ runner.temp }}/digests
211+
env:
212+
SOURCE_DATE_EPOCH: ${{ needs.seed.outputs.timestamp }}
213+
run: |
214+
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
215+
$(printf 'ghcr.io/reactive-firewall/featherhash-shasum@sha256:%s ' *)
216+
217+
- name: Inspect image
218+
run: |
219+
docker buildx imagetools inspect ghcr.io/reactive-firewall/featherhash-shasum:${{ steps.meta.outputs.version }}
220+
221+
- name: Ensure image is pullable locally
222+
run: |
223+
# ensure the platform-specific image manifest is present locally for Syft/Grype
224+
docker pull ghcr.io/reactive-firewall/featherhash-shasum:${{ steps.meta.outputs.version }}
225+
226+
- name: Pull Syft and Grype images
227+
run: |
228+
# ensure the Syft and Grype images are available
229+
docker pull anchore/syft:v1.31.0
230+
docker pull anchore/grype:v0.98.0
231+
232+
- name: Generate SBOM (Syft) for this architecture
233+
env:
234+
IMAGE: ghcr.io/reactive-firewall/featherhash-shasum:${{ steps.meta.outputs.version }}
235+
run: |
236+
SYFT_IMG=anchore/syft:v1.31.0 # adjust version if desired
237+
docker run --rm \
238+
-v /var/run/docker.sock:/var/run/docker.sock \
239+
$SYFT_IMG ${IMAGE} -o spdx-json > sbom.json
240+
241+
- name: Scan image with Grype (vulnerability) and export results
242+
env:
243+
IMAGE: ghcr.io/reactive-firewall/featherhash-shasum:${{ steps.meta.outputs.version }}
244+
run: |
245+
GRYPE_IMG=anchore/grype:v0.98.0
246+
# run grype against the image and produce JSON output
247+
docker run --rm \
248+
-v /var/run/docker.sock:/var/run/docker.sock \
249+
$GRYPE_IMG ${IMAGE} -o json > grype.json || true
250+
# (grype exits non-zero on findings; keep the job green by allowing non-zero)
251+
252+
- name: Upload per-arch SBOM and Grype report
253+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
254+
with:
255+
name: sbom-and-scan
256+
path: |
257+
sbom.json
258+
259+
- name: Logout from Docker Hub
260+
run: docker logout

0 commit comments

Comments
 (0)