Skip to content
This repository was archived by the owner on Mar 19, 2026. It is now read-only.

Commit 55a60ee

Browse files
tulilirockztulilirockz
committed
feat: add automation for building this in CI
Signed-off-by: Tulip Blossom <tulilirockz@proton.me>
1 parent 298c2da commit 55a60ee

File tree

4 files changed

+165
-0
lines changed

4 files changed

+165
-0
lines changed

‎.github/renovate.json5‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{
2+
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
3+
"extends": [
4+
"config:best-practices",
5+
],
6+
7+
"rebaseWhen": "never",
8+
9+
"packageRules": [
10+
{
11+
"automerge": true,
12+
"matchUpdateTypes": ["pin", "pinDigest"]
13+
},
14+
{
15+
"enabled": false,
16+
"matchUpdateTypes": ["digest", "pinDigest", "pin"],
17+
"matchDepTypes": ["container"],
18+
"matchFileNames": [".github/workflows/**.yaml", ".github/workflows/**.yml"],
19+
},
20+
]
21+
}

‎.github/workflows/build.yaml‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
---
2+
name: Build container image
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
schedule:
8+
- cron: "05 10 * * *" # 10:05am UTC everyday
9+
push:
10+
branches:
11+
- main
12+
paths-ignore:
13+
- "**/README.md"
14+
workflow_dispatch:
15+
16+
env:
17+
IMAGE_DESC: "Experimental arch-bootc POC image"
18+
IMAGE_KEYWORDS: "bootc,archlinux,arch"
19+
IMAGE_LOGO_URL: "https://avatars.githubusercontent.com/u/4673648?s=200&v=4"
20+
IMAGE_NAME: "${{ github.event.repository.name }}"
21+
IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"
22+
DEFAULT_TAG: "latest"
23+
24+
concurrency:
25+
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }}
26+
cancel-in-progress: true
27+
28+
jobs:
29+
build_push:
30+
name: Build and push image
31+
runs-on: ubuntu-24.04
32+
33+
permissions:
34+
contents: read
35+
packages: write
36+
id-token: write
37+
38+
steps:
39+
- name: Prepare environment
40+
run: |
41+
# Lowercase the image uri
42+
echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
43+
echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
44+
45+
# These stage versions are pinned by https://github.com/renovatebot/renovate
46+
- name: Checkout
47+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
48+
49+
- name: Get current date
50+
id: date
51+
run: |
52+
# This generates a timestamp like what is defined on the ArtifactHub documentation
53+
# E.G: 2022-02-08T15:38:15Z'
54+
# https://artifacthub.io/docs/topics/repositories/container-images/
55+
# https://linux.die.net/man/1/date
56+
echo "date=$(date -u +%Y\-%m\-%d\T%H\:%M\:%S\Z)" >> $GITHUB_OUTPUT
57+
58+
- name: Image Metadata
59+
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5
60+
id: metadata
61+
with:
62+
tags: |
63+
type=raw,value=${{ env.DEFAULT_TAG }}
64+
type=raw,value=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}}
65+
type=raw,value={{date 'YYYYMMDD'}}
66+
type=sha,enable=${{ github.event_name == 'pull_request' }}
67+
type=ref,event=pr
68+
labels: |
69+
io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/refs/heads/main/README.md
70+
org.opencontainers.image.created=${{ steps.date.outputs.date }}
71+
org.opencontainers.image.description=${{ env.IMAGE_DESC }}
72+
org.opencontainers.image.documentation=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/refs/heads/main/README.md
73+
org.opencontainers.image.source=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/blob/main/Containerfile
74+
org.opencontainers.image.title=${{ env.IMAGE_NAME }}
75+
org.opencontainers.image.url=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}
76+
org.opencontainers.image.vendor=${{ github.repository_owner }}
77+
org.opencontainers.image.version=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}}
78+
io.artifacthub.package.deprecated=false
79+
io.artifacthub.package.keywords=${{ env.IMAGE_KEYWORDS }}
80+
io.artifacthub.package.license=Apache-2.0
81+
io.artifacthub.package.logo-url=${{ env.IMAGE_LOGO_URL }}
82+
io.artifacthub.package.prerelease=false
83+
containers.bootc=1
84+
sep-tags: " "
85+
sep-annotations: " "
86+
87+
- name: Build Image
88+
id: build_image
89+
uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2
90+
with:
91+
containerfiles: |
92+
./Containerfile
93+
# Postfix image name with -custom to make it a little more descriptive
94+
# Syntax: https://docs.github.com/en/actions/learn-github-actions/expressions#format
95+
image: ${{ env.IMAGE_NAME }}
96+
tags: ${{ steps.metadata.outputs.tags }}
97+
labels: ${{ steps.metadata.outputs.labels }}
98+
oci: false
99+
100+
- name: Login to GitHub Container Registry
101+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3
102+
if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
103+
with:
104+
registry: ghcr.io
105+
username: ${{ github.actor }}
106+
password: ${{ secrets.GITHUB_TOKEN }}
107+
108+
- name: Push To GHCR
109+
uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
110+
if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
111+
id: push
112+
env:
113+
REGISTRY_USER: ${{ github.actor }}
114+
REGISTRY_PASSWORD: ${{ github.token }}
115+
with:
116+
registry: ${{ env.IMAGE_REGISTRY }}
117+
image: ${{ env.IMAGE_NAME }}
118+
tags: ${{ steps.metadata.outputs.tags }}
119+
username: ${{ env.REGISTRY_USER }}
120+
password: ${{ env.REGISTRY_PASSWORD }}
121+
122+
- name: Install Cosign
123+
uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
124+
if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
125+
126+
- name: Sign container image
127+
if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
128+
run: |
129+
IMAGE_FULL="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}"
130+
for tag in ${{ steps.metadata.outputs.tags }}; do
131+
cosign sign -y --key env://COSIGN_PRIVATE_KEY $IMAGE_FULL:$tag
132+
done
133+
env:
134+
TAGS: ${{ steps.push.outputs.digest }}
135+
COSIGN_EXPERIMENTAL: false
136+
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}

‎.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
cosign.key
2+
_build_*
3+
output
4+
_build-*/**

‎cosign.pub‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
-----BEGIN PUBLIC KEY-----
2+
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIaGOPFGPMwmfPHv7rPN6s6rcyFLx
3+
YaccPUbgEgOy4MD2d4y8LE2fFGOmu/UNdVRs62CacIlhOqRDS1bA142/Pw==
4+
-----END PUBLIC KEY-----

0 commit comments

Comments
 (0)