Add erofs support to apko. #4859
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build Images | |
| on: | |
| pull_request: | |
| branches: [ "main" ] | |
| push: | |
| branches: [ "main" ] | |
| workflow_dispatch: | |
| permissions: {} | |
| jobs: | |
| # Build a single-arch nginx image for each arch. | |
| build-nginx-on-all-arches: | |
| name: build-nginx-all-arches | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| arch: [x86_64, aarch64] | |
| steps: | |
| - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: block | |
| allowed-endpoints: > | |
| *.blob.core.windows.net:443 | |
| *.githubapp.com:443 | |
| 9236a389bd48b984df91adc1bc924620.r2.cloudflarestorage.com:443 | |
| alpinelinux.org:443 | |
| api.github.com:443 | |
| apk.cgr.dev:443 | |
| auth.docker.io:443 | |
| cgr.dev:443 | |
| dl-cdn.alpinelinux.org:443 | |
| dl.google.com:443 | |
| github.com:443 | |
| go.dev:443 | |
| objects.githubusercontent.com:443 | |
| packages.wolfi.dev:443 | |
| production.cloudflare.docker.com:443 | |
| production.cloudfront.docker.com:443 | |
| proxy.golang.org:443 | |
| registry-1.docker.io:443 | |
| release-assets.githubusercontent.com:443 | |
| spdx.org:443 | |
| storage.googleapis.com:443 | |
| sum.golang.org:443 | |
| updates.cdn-apple.com:443 | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| check-latest: true | |
| - name: Setup QEMU | |
| uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 | |
| - env: | |
| MATRIX_ARCH: ${{ matrix.arch }} | |
| run: | | |
| make apko | |
| ./apko build ./examples/nginx.yaml nginx:build "/tmp/nginx-${MATRIX_ARCH}.tar" --arch "${MATRIX_ARCH}" | |
| - name: Check SBOM Conformance | |
| run: | | |
| set -euxo pipefail | |
| if ! ls ./*.spdx.json; then | |
| echo "no SBOMs found!" | |
| exit 1 | |
| fi | |
| for f in ./*.spdx.json; do | |
| echo ::group::sbom.json | |
| cat "$f" | |
| echo ::endgroup:: | |
| docker run --rm -v "$(pwd)/$f:/$f" --entrypoint "sh" cgr.dev/chainguard/wolfi-base -c "apk add spdx-tools-java && tools-java Verify /$f" | |
| done | |
| build-all-examples-one-arch: | |
| name: build-all-examples-amd64 | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| platform: [ubuntu-latest, macos-latest] | |
| runs-on: ${{ matrix.platform }} | |
| steps: | |
| - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: block | |
| allowed-endpoints: > | |
| *.apple.com:443 | |
| *.blob.core.windows.net:443 | |
| *.githubapp.com:443 | |
| 9236a389bd48b984df91adc1bc924620.r2.cloudflarestorage.com:443 | |
| alpinelinux.org:443 | |
| api.github.com:443 | |
| apk.cgr.dev:443 | |
| auth.docker.io:443 | |
| cp*.cloudflare.com | |
| cgr.dev:443 | |
| dl-cdn.alpinelinux.org:443 | |
| dl.google.com:443 | |
| github.com:443 | |
| go.dev:443 | |
| objects.githubusercontent.com:443 | |
| packages.wolfi.dev:443 | |
| production.cloudflare.docker.com:443 | |
| production.cloudfront.docker.com:443 | |
| proxy.golang.org:443 | |
| registry-1.docker.io:443 | |
| release-assets.githubusercontent.com:443 | |
| spdx.org:443 | |
| storage.googleapis.com:443 | |
| sum.golang.org:443 | |
| updates.cdn-apple.com:443 | |
| updates-http.cdn-apple.com:80 | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| check-latest: true | |
| - uses: imjasonh/setup-crane@feee3b6bb0d4c68370f256a4502498c9227e5c6b # v0.7 | |
| - run: | | |
| make apko | |
| while IFS= read -r cfg; do | |
| name=$(basename "${cfg}" .yaml) | |
| echo "Building ${name}..." | |
| build_script=$(dirname "${cfg}")/build.sh | |
| if [ -f "${build_script}" ]; then | |
| "${build_script}" ./apko | |
| else | |
| ./apko build "${cfg}" "${name}:build" /tmp/"${name}".tar | |
| ./apko build --offline "${cfg}" "${name}:build" /tmp/"${name}".tar | |
| fi | |
| done < <(find ./examples/ -name '*.yaml') | |
| build-wolfi-source-date-epoch: | |
| name: source-date-epoch | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: block | |
| allowed-endpoints: > | |
| *.blob.core.windows.net:443 | |
| *.githubapp.com:443 | |
| 9236a389bd48b984df91adc1bc924620.r2.cloudflarestorage.com:443 | |
| alpinelinux.org:443 | |
| api.github.com:443 | |
| apk.cgr.dev:443 | |
| auth.docker.io:443 | |
| cgr.dev:443 | |
| dl-cdn.alpinelinux.org:443 | |
| dl.google.com:443 | |
| github.com:443 | |
| go.dev:443 | |
| objects.githubusercontent.com:443 | |
| packages.wolfi.dev:443 | |
| production.cloudflare.docker.com:443 | |
| production.cloudfront.docker.com:443 | |
| proxy.golang.org:443 | |
| registry-1.docker.io:443 | |
| release-assets.githubusercontent.com:443 | |
| spdx.org:443 | |
| storage.googleapis.com:443 | |
| sum.golang.org:443 | |
| updates.cdn-apple.com:443 | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| check-latest: true | |
| - uses: chainguard-dev/actions/setup-registry@b2555de0cf9724fb9b49d050ff18bd1f49562ba7 # v1.6.29 | |
| with: | |
| port: 5000 | |
| - name: build image (w/ source date epoch) | |
| env: | |
| SOURCE_DATE_EPOCH: "0" | |
| run: | | |
| make apko | |
| FIRST=$(./apko publish ./examples/wolfi-base.yaml localhost:5000/wolfi --arch x86_64,aarch64 2> /dev/null) | |
| for idx in {2..10} | |
| do | |
| NEXT=$(./apko publish ./examples/wolfi-base.yaml localhost:5000/wolfi --arch x86_64,aarch64 2> /dev/null) | |
| if [ "${FIRST}" = "${NEXT}" ]; then | |
| echo "Build ${idx} matches." | |
| else | |
| echo "Build ${idx} differs: ${FIRST} and ${NEXT}" | |
| exit 1 | |
| fi | |
| done | |
| build-wolfi-build-date-epoch: | |
| name: build-date-epoch | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: block | |
| allowed-endpoints: > | |
| *.blob.core.windows.net:443 | |
| *.githubapp.com:443 | |
| 9236a389bd48b984df91adc1bc924620.r2.cloudflarestorage.com:443 | |
| alpinelinux.org:443 | |
| api.github.com:443 | |
| apk.cgr.dev:443 | |
| auth.docker.io:443 | |
| cgr.dev:443 | |
| dl-cdn.alpinelinux.org:443 | |
| dl.google.com:443 | |
| github.com:443 | |
| go.dev:443 | |
| objects.githubusercontent.com:443 | |
| packages.wolfi.dev:443 | |
| production.cloudflare.docker.com:443 | |
| production.cloudfront.docker.com:443 | |
| proxy.golang.org:443 | |
| registry-1.docker.io:443 | |
| release-assets.githubusercontent.com:443 | |
| spdx.org:443 | |
| storage.googleapis.com:443 | |
| sum.golang.org:443 | |
| updates.cdn-apple.com:443 | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| check-latest: true | |
| - uses: chainguard-dev/actions/setup-registry@b2555de0cf9724fb9b49d050ff18bd1f49562ba7 # v1.6.29 | |
| with: | |
| port: 5000 | |
| - name: build image (w/ build date epoch) | |
| run: | | |
| make apko | |
| # Without SOURCE_DATE_EPOCH set, the timestamp of the image will be computed to be | |
| # the maximum build date of the resolved APKs. | |
| FIRST=$(./apko publish ./examples/wolfi-base.yaml localhost:5000/wolfi --arch x86_64,aarch64 2> /dev/null) | |
| for idx in {2..10} | |
| do | |
| NEXT=$(./apko publish ./examples/wolfi-base.yaml localhost:5000/wolfi --arch x86_64,aarch64 2> /dev/null) | |
| if [ "${FIRST}" = "${NEXT}" ]; then | |
| echo "Build ${idx} matches." | |
| else | |
| echo "Build ${idx} differs: ${FIRST} and ${NEXT}" | |
| exit 1 | |
| fi | |
| done | |
| annotations: | |
| name: annotations | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: block | |
| allowed-endpoints: > | |
| *.blob.core.windows.net:443 | |
| *.githubapp.com:443 | |
| 9236a389bd48b984df91adc1bc924620.r2.cloudflarestorage.com:443 | |
| alpinelinux.org:443 | |
| api.github.com:443 | |
| apk.cgr.dev:443 | |
| auth.docker.io:443 | |
| cgr.dev:443 | |
| dl-cdn.alpinelinux.org:443 | |
| dl.google.com:443 | |
| github.com:443 | |
| go.dev:443 | |
| objects.githubusercontent.com:443 | |
| packages.wolfi.dev:443 | |
| production.cloudflare.docker.com:443 | |
| production.cloudfront.docker.com:443 | |
| proxy.golang.org:443 | |
| registry-1.docker.io:443 | |
| release-assets.githubusercontent.com:443 | |
| spdx.org:443 | |
| storage.googleapis.com:443 | |
| sum.golang.org:443 | |
| updates.cdn-apple.com:443 | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| check-latest: true | |
| - uses: imjasonh/setup-crane@feee3b6bb0d4c68370f256a4502498c9227e5c6b # v0.7 | |
| - uses: chainguard-dev/actions/setup-registry@b2555de0cf9724fb9b49d050ff18bd1f49562ba7 # v1.6.29 | |
| with: | |
| port: 5000 | |
| - run: | | |
| make apko | |
| # Build image with annotations. | |
| ref=$(./apko publish ./examples/nginx.yaml localhost:5000/nginx --arch x86_64,aarch64) | |
| # Check index annotations. | |
| crane manifest "$ref" | jq -r '.annotations.foo' | grep bar | |
| # Check per-image annotations. | |
| crane manifest --platform=linux/arm64 "$ref" | jq -r '.annotations.foo' | grep bar | |
| # Check per-image config labels. | |
| crane config --platform=linux/arm64 "$ref" | jq -r '.config.Labels' | grep bar | |
| certificates: | |
| name: certificates | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: block | |
| allowed-endpoints: > | |
| *.blob.core.windows.net:443 | |
| *.githubapp.com:443 | |
| 9236a389bd48b984df91adc1bc924620.r2.cloudflarestorage.com:443 | |
| alpinelinux.org:443 | |
| api.github.com:443 | |
| apk.cgr.dev:443 | |
| auth.docker.io:443 | |
| cgr.dev:443 | |
| dl-cdn.alpinelinux.org:443 | |
| dl.google.com:443 | |
| github.com:443 | |
| go.dev:443 | |
| objects.githubusercontent.com:443 | |
| packages.wolfi.dev:443 | |
| production.cloudflare.docker.com:443 | |
| production.cloudfront.docker.com:443 | |
| proxy.golang.org:443 | |
| registry-1.docker.io:443 | |
| release-assets.githubusercontent.com:443 | |
| spdx.org:443 | |
| storage.googleapis.com:443 | |
| sum.golang.org:443 | |
| updates.cdn-apple.com:443 | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| check-latest: true | |
| - name: test additional certificates | |
| run: | | |
| ./hack/test-certificates.sh ./examples/certificates.yaml \ | |
| "E7:05:70:A9:89:F8:56:5A:AB:DF:7C:AE:27:AB:D1:62:18:72:D6:A3:F8:11:E3:FE:F2:7E:3D:BA:02:91:21:98" \ | |
| "9B:2A:33:9F:E6:A3:E8:55:85:C4:CD:75:53:6C:B8:C1:CF:7C:D6:03:B9:A6:4B:EC:25:21:85:8A:E4:8D:A8:5D" | |
| package-certificates: | |
| name: package-certificates | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: block | |
| allowed-endpoints: > | |
| *.blob.core.windows.net:443 | |
| *.githubapp.com:443 | |
| 9236a389bd48b984df91adc1bc924620.r2.cloudflarestorage.com:443 | |
| alpinelinux.org:443 | |
| api.github.com:443 | |
| apk.cgr.dev:443 | |
| auth.docker.io:443 | |
| cgr.dev:443 | |
| dl-cdn.alpinelinux.org:443 | |
| dl.google.com:443 | |
| github.com:443 | |
| go.dev:443 | |
| objects.githubusercontent.com:443 | |
| packages.wolfi.dev:443 | |
| production.cloudflare.docker.com:443 | |
| production.cloudfront.docker.com:443 | |
| proxy.golang.org:443 | |
| registry-1.docker.io:443 | |
| release-assets.githubusercontent.com:443 | |
| spdx.org:443 | |
| storage.googleapis.com:443 | |
| sum.golang.org:443 | |
| updates.cdn-apple.com:443 | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| check-latest: true | |
| - name: test package-provided certificates | |
| run: | | |
| ./hack/test-certificates.sh ./examples/package-certificates.yaml \ | |
| "E7:05:70:A9:89:F8:56:5A:AB:DF:7C:AE:27:AB:D1:62:18:72:D6:A3:F8:11:E3:FE:F2:7E:3D:BA:02:91:21:98" \ | |
| "9B:2A:33:9F:E6:A3:E8:55:85:C4:CD:75:53:6C:B8:C1:CF:7C:D6:03:B9:A6:4B:EC:25:21:85:8A:E4:8D:A8:5D" \ | |
| "34:75:37:AF:7A:09:D4:03:F1:9F:58:F8:3C:35:68:91:2A:F2:4B:7C:12:E7:45:F1:D5:55:70:79:70:8C:91:AD" \ | |
| "12:AE:34:99:9A:A6:4D:CD:1A:69:47:E8:38:A5:3A:AB:AB:FC:FA:CA:45:AB:CA:8D:C0:CB:B8:DC:B7:BD:06:3C" |