Skip to content

Commit faa3f5d

Browse files
ayuskauskasayuskauskas
committed
feat(ci/github): organize each container build into its own workflow for clarity and appropriate filters on file changes
1 parent 294ff41 commit faa3f5d

File tree

2 files changed

+71
-53
lines changed

2 files changed

+71
-53
lines changed

.github/workflows/build_agent_container.yaml renamed to .github/workflows/agent-container.yaml

Lines changed: 2 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,10 @@ name: Build and push container image
33
# Configures this workflow to run every time a tag is created
44
on:
55
push:
6-
branches:
7-
- main
86
paths:
97
- agent/**
10-
- .github/workflows/build_agent_container.yaml
8+
- containers/agent.Dockerfile
9+
- .github/workflows/agent-container.yaml
1110

1211
# NOTE: we may want to switch to matrix build for multi-platform support if this is taking too long
1312
# https://docs.docker.com/build/ci/github-actions/multi-platform/#distribute-build-across-multiple-runners
@@ -17,7 +16,6 @@ on:
1716
env:
1817
REGISTRY: ghcr.io
1918
IMAGE_NAME: ${{ github.repository }}
20-
DOCKER_CMD: docker
2119

2220
# There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
2321
jobs:
@@ -72,52 +70,3 @@ jobs:
7270
subject-digest: ${{ steps.build.outputs.digest }}
7371
push-to-registry: true
7472

75-
build-and-publish-agentless:
76-
runs-on: ubuntu-latest
77-
# Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
78-
permissions:
79-
contents: read
80-
packages: write
81-
attestations: write
82-
id-token: write
83-
steps:
84-
- name: Checkout repository
85-
uses: actions/checkout@v4
86-
# Uses the `docker/login-action` action to log in to the Container registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
87-
- name: Log in to the Container registry
88-
uses: docker/login-action@v3
89-
with:
90-
registry: ${{ env.REGISTRY }}
91-
username: ${{ github.actor }}
92-
password: ${{ secrets.GITHUB_TOKEN }}
93-
94-
# Setup for multi-platform
95-
- name: Set up QEMU
96-
uses: docker/setup-qemu-action@v3
97-
98-
- name: Set up Docker Buildx
99-
uses: docker/setup-buildx-action@v3
100-
101-
- name: Build the agent container image
102-
id: build
103-
run: |
104-
source ./containers/agentless/versions.sh
105-
cd agent
106-
export TAGS=()
107-
for version in $TEST_VERSIONS; do
108-
TAGS+="-t ${{ env.REGISTRY }}/${{env.IMAGE_NAME}}/agentless:$version "
109-
done
110-
111-
docker buildx build --push --platform linux/amd64,linux/arm64 $TAGS --metadata-file=metadata.json -f ../containers/agentless/Dockerfile ../containers/agentless
112-
113-
cat metadata.json
114-
echo "digest=$(cat metadata.json | jq -r .\"containerimage.digest\")" >> $GITHUB_OUTPUT
115-
cat $GITHUB_OUTPUT
116-
117-
# This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see [AUTOTITLE](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds).
118-
- name: Generate artifact attestation
119-
uses: actions/attest-build-provenance@v2
120-
with:
121-
subject-name: ${{ env.REGISTRY }}/${{env.IMAGE_NAME}}/agentless
122-
subject-digest: ${{ steps.build.outputs.digest }}
123-
push-to-registry: true

‎.github/workflows/agentless-container.yaml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
name: Build and push agentless container image
2+
3+
# Configures this workflow to run every time a tag is created
4+
on:
5+
push:
6+
branches:
7+
- main
8+
paths:
9+
- containers/agentless/**
10+
- .github/workflows/agentless-container.yaml
11+
12+
# NOTE: we may want to switch to matrix build for multi-platform support if this is taking too long
13+
# https://docs.docker.com/build/ci/github-actions/multi-platform/#distribute-build-across-multiple-runners
14+
15+
16+
# Defines two custom environment variables for the workflow. These are used for the Container registry domain, and a name for the Docker image that this workflow builds.
17+
env:
18+
REGISTRY: ghcr.io
19+
IMAGE_NAME: ${{ github.repository }}
20+
DOCKER_CMD: docker
21+
build-and-publish-agentless:
22+
runs-on: ubuntu-latest
23+
# Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
24+
permissions:
25+
contents: read
26+
packages: write
27+
attestations: write
28+
id-token: write
29+
steps:
30+
- name: Checkout repository
31+
uses: actions/checkout@v4
32+
# Uses the `docker/login-action` action to log in to the Container registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
33+
- name: Log in to the Container registry
34+
uses: docker/login-action@v3
35+
with:
36+
registry: ${{ env.REGISTRY }}
37+
username: ${{ github.actor }}
38+
password: ${{ secrets.GITHUB_TOKEN }}
39+
40+
# Setup for multi-platform
41+
- name: Set up QEMU
42+
uses: docker/setup-qemu-action@v3
43+
44+
- name: Set up Docker Buildx
45+
uses: docker/setup-buildx-action@v3
46+
47+
- name: Build the agent container image
48+
id: build
49+
run: |
50+
source ./containers/agentless/versions.sh
51+
cd agent
52+
export TAGS=()
53+
for version in $TEST_VERSIONS; do
54+
TAGS+="-t ${{ env.REGISTRY }}/${{env.IMAGE_NAME}}/agentless:$version "
55+
done
56+
57+
docker buildx build --push --platform linux/amd64,linux/arm64 $TAGS --metadata-file=metadata.json -f ../containers/agentless/Dockerfile ../containers/agentless
58+
59+
cat metadata.json
60+
echo "digest=$(cat metadata.json | jq -r .\"containerimage.digest\")" >> $GITHUB_OUTPUT
61+
cat $GITHUB_OUTPUT
62+
63+
# This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see [AUTOTITLE](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds).
64+
- name: Generate artifact attestation
65+
uses: actions/attest-build-provenance@v2
66+
with:
67+
subject-name: ${{ env.REGISTRY }}/${{env.IMAGE_NAME}}/agentless
68+
subject-digest: ${{ steps.build.outputs.digest }}
69+
push-to-registry: true

0 commit comments

Comments
 (0)