Skip to content

Commit 47e2820

Browse files
brendan-kellamgithub-advanced-security[bot]
brendan-kellam
and
github-advanced-security[bot]
authored
fix: Add back temporary workflow to publish main to ghcr (#725)
* wip * wip * nits * Potential fix for code scanning alert no. 22: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * feedback --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
1 parent 4ce474a commit 47e2820

File tree

4 files changed

+249
-144
lines changed

4 files changed

+249
-144
lines changed

‎.github/workflows/_build.yml‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
# Internal reusable workflow for building multi-platform Docker images.
2+
#
3+
# This workflow builds Docker images for linux/amd64 and linux/arm64 platforms,
4+
# pushes them by digest to GHCR, signs them with cosign/Sigstore for supply chain
5+
# security, and uploads build artifacts for subsequent manifest creation.
6+
#
7+
# @ see: https://docs.docker.com/build/ci/github-actions/multi-platform/#distribute-build-across-multiple-runners
8+
9+
name: Build Multi-Platform Images
10+
11+
on:
12+
workflow_call:
13+
inputs:
14+
git_ref:
15+
description: "Git ref to checkout"
16+
required: true
17+
type: string
18+
docker_tags:
19+
description: "Docker tags configuration (JSON array or raw tags)"
20+
required: true
21+
type: string
22+
use_app_token:
23+
description: "Whether to use GitHub App token for checkout"
24+
required: false
25+
type: boolean
26+
default: false
27+
secrets:
28+
release_app_id:
29+
description: "GitHub App ID (required if use_app_token is true)"
30+
required: false
31+
release_app_private_key:
32+
description: "GitHub App private key (required if use_app_token is true)"
33+
required: false
34+
35+
env:
36+
REGISTRY_IMAGE: ghcr.io/sourcebot-dev/sourcebot
37+
38+
jobs:
39+
build:
40+
runs-on: ${{ matrix.runs-on}}
41+
environment: oss
42+
permissions:
43+
contents: read
44+
packages: write
45+
# Required for keyless signing with cosign/Sigstore.
46+
# Allows workflow to obtain OIDC token for ephemeral certificate from Fulcio.
47+
id-token: write
48+
strategy:
49+
matrix:
50+
platform: [linux/amd64, linux/arm64]
51+
include:
52+
- platform: linux/amd64
53+
runs-on: ubuntu-latest
54+
- platform: linux/arm64
55+
runs-on: ubuntu-24.04-arm
56+
57+
steps:
58+
- name: Generate GitHub App token
59+
if: inputs.use_app_token
60+
id: generate_token
61+
uses: actions/create-github-app-token@v1
62+
with:
63+
app-id: ${{ secrets.release_app_id }}
64+
private-key: ${{ secrets.release_app_private_key }}
65+
66+
- name: Prepare
67+
run: |
68+
platform=${{ matrix.platform }}
69+
echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
70+
71+
- name: Checkout repository
72+
uses: actions/checkout@v4
73+
with:
74+
ref: ${{ inputs.git_ref }}
75+
submodules: "true"
76+
fetch-depth: 0
77+
token: ${{ inputs.use_app_token && steps.generate_token.outputs.token || github.token }}
78+
79+
# Extract metadata (tags, labels) for Docker
80+
# https://github.com/docker/metadata-action
81+
- name: Extract Docker metadata
82+
id: meta
83+
uses: docker/metadata-action@v5
84+
with:
85+
images: ${{ env.REGISTRY_IMAGE }}
86+
tags: ${{ inputs.docker_tags }}
87+
88+
# Install the cosign tool except on PR
89+
# https://github.com/sigstore/cosign-installer
90+
- name: Install cosign
91+
uses: sigstore/cosign-installer@v3.5.0
92+
with:
93+
cosign-release: "v2.2.4"
94+
95+
- name: Set up Docker Buildx
96+
uses: docker/setup-buildx-action@v3
97+
98+
- name: Login to GitHub Packages Docker Registry
99+
uses: docker/login-action@v3
100+
with:
101+
registry: ghcr.io
102+
username: ${{ github.actor }}
103+
password: ${{ secrets.GITHUB_TOKEN }}
104+
105+
- name: Build Docker image
106+
id: build
107+
uses: docker/build-push-action@v6
108+
with:
109+
context: .
110+
labels: ${{ steps.meta.outputs.labels }}
111+
cache-from: type=gha,scope=${{ env.PLATFORM_PAIR }}
112+
cache-to: type=gha,mode=max,scope=${{ env.PLATFORM_PAIR }}
113+
platforms: ${{ matrix.platform }}
114+
outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true,annotation.org.opencontainers.image.description=Blazingly fast code search
115+
116+
- name: Export digest
117+
run: |
118+
mkdir -p /tmp/digests
119+
digest="${{ steps.build.outputs.digest }}"
120+
touch "/tmp/digests/${digest#sha256:}"
121+
122+
- name: Upload digest
123+
uses: actions/upload-artifact@v4
124+
with:
125+
name: digests-${{ env.PLATFORM_PAIR }}
126+
path: /tmp/digests/*
127+
if-no-files-found: error
128+
retention-days: 1
129+
130+
# Sign the resulting Docker image digest except on PRs.
131+
# This will only write to the public Rekor transparency log when the Docker
132+
# repository is public to avoid leaking data. If you would like to publish
133+
# transparency data even for private images, pass --force to cosign below.
134+
# https://github.com/sigstore/cosign
135+
- name: Sign the published Docker image
136+
env:
137+
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
138+
TAGS: ${{ steps.meta.outputs.tags }}
139+
DIGEST: ${{ steps.build.outputs.digest }}
140+
# This step uses the identity token to provision an ephemeral certificate
141+
# against the sigstore community Fulcio instance.
142+
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
143+

‎.github/workflows/_merge.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Internal reusable workflow for merging platform-specific image digests into a
2+
# single multi-platform manifest and pushing to GHCR.
3+
#
4+
# This workflow takes the individual platform image digests created by _build.yml,
5+
# combines them into a multi-platform manifest, and pushes the final tagged images.
6+
7+
name: Merge Multi-Platform Manifest
8+
9+
on:
10+
workflow_call:
11+
inputs:
12+
docker_tags:
13+
description: "Docker tags configuration (JSON array or raw tags)"
14+
required: true
15+
type: string
16+
17+
env:
18+
REGISTRY_IMAGE: ghcr.io/sourcebot-dev/sourcebot
19+
20+
jobs:
21+
merge:
22+
runs-on: ubuntu-latest
23+
permissions:
24+
packages: write
25+
steps:
26+
- name: Download digests
27+
uses: actions/download-artifact@v4
28+
with:
29+
path: /tmp/digests
30+
pattern: digests-*
31+
merge-multiple: true
32+
33+
- name: Set up Docker Buildx
34+
uses: docker/setup-buildx-action@v3
35+
36+
- name: Extract Docker metadata
37+
id: meta
38+
uses: docker/metadata-action@v5
39+
with:
40+
images: ${{ env.REGISTRY_IMAGE }}
41+
tags: ${{ inputs.docker_tags }}
42+
43+
- name: Login to GitHub Packages Docker Registry
44+
uses: docker/login-action@v3
45+
with:
46+
registry: ghcr.io
47+
username: ${{ github.actor }}
48+
password: ${{ secrets.GITHUB_TOKEN }}
49+
50+
- name: Create manifest list and push
51+
working-directory: /tmp/digests
52+
run: |
53+
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
54+
$(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
55+
56+
- name: Inspect image
57+
run: |
58+
docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}
59+

‎.github/workflows/release-dev.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Release Sourcebot (Development)
2+
3+
permissions:
4+
contents: read
5+
6+
on:
7+
push:
8+
branches: ["main"]
9+
10+
jobs:
11+
build:
12+
uses: ./.github/workflows/_build.yml
13+
with:
14+
git_ref: ${{ github.ref_name }}
15+
docker_tags: type=raw,value=main
16+
use_app_token: false
17+
secrets: inherit
18+
19+
publish-to-registry:
20+
needs: build
21+
uses: ./.github/workflows/_merge.yml
22+
with:
23+
docker_tags: type=raw,value=main

0 commit comments

Comments
 (0)