Merge pull request #34 from Fortiphyd/more-flexible-networking #30
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Push Multi-Arch Docker Images | |
| permissions: | |
| contents: read | |
| id-token: write | |
| on: | |
| push: | |
| branches: [ main ] | |
| paths-ignore: | |
| - '**.md' | |
| - 'docs/**' | |
| release: | |
| types: [ published ] | |
| env: | |
| DOCKERHUB_NAMESPACE: fortiphyd | |
| DOCKER_TAG: ${{ github.ref_type == 'tag' && github.ref_name || 'latest' }} | |
| jobs: | |
| detect-changes: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| services: ${{ steps.set-services.outputs.services }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - id: set-services | |
| run: | | |
| set -e | |
| SERVICES=() | |
| BASE_REF="${{ github.event.before }}" | |
| if [ -z "$BASE_REF" ]; then | |
| BASE_REF="$(git rev-parse HEAD~1)" | |
| fi | |
| CHANGED=$(git diff --name-only "$BASE_REF" HEAD) | |
| echo "Changed files:" | |
| echo "$CHANGED" | |
| declare -A MAP=( | |
| ["plc"]="plc/" | |
| ["router"]="router/" | |
| ["workstation"]="workstation/" | |
| ["simulation"]="simulation/" | |
| ["scadalts"]="scadalts/" | |
| ["attacker"]="attacker/" | |
| ["caldera"]="caldera/" | |
| ) | |
| # rebuild everything on release | |
| if [ "${{ github.event_name }}" = "release" ]; then | |
| SERVICES=("${!MAP[@]}") | |
| else | |
| for SERVICE in "${!MAP[@]}"; do | |
| if echo "$CHANGED" | grep -q "^${MAP[$SERVICE]}"; then | |
| SERVICES+=("$SERVICE") | |
| fi | |
| done | |
| # If shared files changed, rebuild everything | |
| if echo "$CHANGED" | grep -Eq "^(docker-compose.yml|\.github/)"; then | |
| SERVICES=("${!MAP[@]}") | |
| fi | |
| fi | |
| echo "services=$(printf '%s\n' "${SERVICES[@]}" | jq -R . | jq -cs .)" >> "$GITHUB_OUTPUT" | |
| # ================================================================ | |
| # Build AMD64 images | |
| # ================================================================ | |
| build-amd64: | |
| needs: detect-changes | |
| if: needs.detect-changes.outputs.services != '[]' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| lfs: true | |
| - uses: docker/setup-buildx-action@v3 | |
| - uses: docker/login-action@v3 | |
| with: | |
| username: fortiphyd | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Build and push amd64 images | |
| run: | | |
| SERVICES=$(echo '${{ needs.detect-changes.outputs.services }}' | jq -r '.[]') | |
| set -euo pipefail | |
| for SERVICE in $SERVICES; do | |
| if [ ! -d "./${SERVICE}" ]; then | |
| echo "⚠️ Skipping ${SERVICE}: directory does not exist" | |
| continue | |
| fi | |
| IMAGE="${DOCKERHUB_NAMESPACE}/grfics-${SERVICE}" | |
| echo "🚀 Building ${IMAGE}:${DOCKER_TAG} (amd64)" | |
| docker buildx build \ | |
| --platform linux/amd64 \ | |
| --tag "${IMAGE}:${DOCKER_TAG}-amd64" \ | |
| --push \ | |
| --cache-from type=gha \ | |
| --cache-to type=gha,mode=max \ | |
| --provenance=true \ | |
| --sbom=true \ | |
| "./${SERVICE}" | |
| echo "🧹 Cleaning local build cache to free space..." | |
| docker builder prune -af || true | |
| docker system prune -af || true | |
| done | |
| # ================================================================ | |
| # Build ARM64 images | |
| # ================================================================ | |
| build-arm64: | |
| needs: detect-changes | |
| if: needs.detect-changes.outputs.services != '[]' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| lfs: true | |
| - uses: docker/setup-qemu-action@v3 # enables ARM emulation | |
| - uses: docker/setup-buildx-action@v3 | |
| - uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Build and push arm64 images | |
| run: | | |
| SERVICES=$(echo '${{ needs.detect-changes.outputs.services }}' | jq -r '.[]') | |
| set -euo pipefail | |
| for SERVICE in $SERVICES; do | |
| if [ ! -d "./${SERVICE}" ]; then | |
| echo "⚠️ Skipping ${SERVICE}: directory does not exist" | |
| continue | |
| fi | |
| IMAGE="${{ secrets.DOCKERHUB_USERNAME }}/grfics-${SERVICE}" | |
| echo "🚀 Building ${IMAGE}:${DOCKER_TAG} (arm64)" | |
| docker buildx build \ | |
| --platform linux/arm64 \ | |
| --tag "${IMAGE}:${DOCKER_TAG}-arm64" \ | |
| --push \ | |
| --cache-from type=gha \ | |
| --cache-to type=gha,mode=max \ | |
| --provenance=true \ | |
| --sbom=true \ | |
| "./${SERVICE}" | |
| echo "🧹 Cleaning local build cache to free space..." | |
| docker builder prune -af || true | |
| docker system prune -af || true | |
| done | |
| # ================================================================ | |
| # Combine manifests once both architectures exist | |
| # ================================================================ | |
| create-manifests: | |
| runs-on: ubuntu-latest | |
| needs: [ detect-changes, build-amd64, build-arm64 ] | |
| if: needs.detect-changes.outputs.services != '[]' | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: docker/setup-buildx-action@v3 | |
| - uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@v3 | |
| with: | |
| cosign-release: "v2.4.1" | |
| - name: Create and push multi-arch manifests + sign | |
| env: | |
| COSIGN_YES: "true" | |
| run: | | |
| set -euo pipefail | |
| SERVICES=$(echo '${{ needs.detect-changes.outputs.services }}' | jq -r '.[]') | |
| for SERVICE in $SERVICES; do | |
| REPO="${DOCKERHUB_NAMESPACE}/grfics-${SERVICE}" | |
| IMAGE="${REPO}:${DOCKER_TAG}" | |
| echo "🔗 Creating multi-arch manifest for ${IMAGE}" | |
| docker buildx imagetools create \ | |
| -t "${IMAGE}" \ | |
| "${REPO}:${DOCKER_TAG}-amd64" \ | |
| "${REPO}:${DOCKER_TAG}-arm64" | |
| echo "✅ Multi-arch manifest published for ${IMAGE}" | |
| echo "🔎 Resolving digest for ${IMAGE}" | |
| DIGEST="$(docker buildx imagetools inspect "${IMAGE}" --format '{{json .Manifest}}' | jq -r '.digest')" | |
| echo "🔏 Signing ${IMAGE}@${DIGEST} (keyless, GitHub OIDC, recursive)" | |
| cosign sign -y "${REPO}@${DIGEST}" | |
| echo "✅ Signed ${IMAGE}@${DIGEST}" | |
| done |