Skip to content

Commit 052d22f

Browse files
Matic Rupnikfl-matic-rupnik
Matic Rupnik
authored and
fl-matic-rupnik
committed
Squash merge feat/image-build-pipeline into main
trigger: testing dogecoin and rippled image build trigger: bitcoind trigger: dogecoin trigger: dogecoin test: change to container tag trigger: bitcoin trigger: bitcoin trigger: bitcoin test: seperate version env docs: added container image section to README test: slsa digest trigger: bitcoin test: slsa permissions test: remove permissions trigger: bitcoin test: added registry-username trigger: bitcoin test: registry-password test: explicit image name test: hard image name feat: dogecoind provenance feat: rippled provenance feat: rippled provenance feat: dogecoin provenance
1 parent b74d93c commit 052d22f

File tree

6 files changed

+381
-14
lines changed

6 files changed

+381
-14
lines changed

‎.github/workflows/release-bitcoind.yml‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
name: Release bitcoind image
2+
3+
on:
4+
push:
5+
branches: ["main"]
6+
tags: ["*"]
7+
paths: ["images/bitcoind/**"]
8+
pull_request:
9+
branches: ["main"]
10+
paths: ["images/bitcoind/**"]
11+
12+
env:
13+
REGISTRY: ghcr.io
14+
IMAGE_NAME: ${{ github.repository }}/bitcoind
15+
16+
permissions:
17+
contents: read
18+
id-token: write
19+
packages: write
20+
actions: read
21+
22+
jobs:
23+
build:
24+
runs-on: ubuntu-latest
25+
permissions:
26+
contents: read
27+
packages: write
28+
id-token: write
29+
outputs:
30+
image: ${{ steps.meta.outputs.tags }}
31+
digest: ${{ steps.build-and-push.outputs.digest }}
32+
33+
steps:
34+
- name: Checkout repository
35+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
36+
37+
- name: Get image tag (strip leading v only for tag)
38+
id: get_image_tag
39+
run: |
40+
RAW_VERSION=$(grep "^ARG VERSION=" images/bitcoind/Dockerfile \
41+
| cut -d'=' -f2 \
42+
| tr -d '"' \
43+
| tr -d "'" \
44+
| tr -d '[:space:]')
45+
46+
VERSION_FOR_GIT=$RAW_VERSION
47+
VERSION_FOR_TAG=${RAW_VERSION#v}
48+
49+
echo "VERSION_FOR_GIT=${VERSION_FOR_GIT}" >> $GITHUB_ENV
50+
echo "VERSION_FOR_TAG=${VERSION_FOR_TAG}" >> $GITHUB_ENV
51+
52+
echo "image_tag=${VERSION_FOR_TAG}" >> $GITHUB_OUTPUT
53+
54+
- name: Install cosign
55+
if: github.event_name != 'pull_request'
56+
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad
57+
with:
58+
cosign-release: "v2.5.3"
59+
60+
- name: Set up Docker Buildx
61+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
62+
63+
- name: Log into registry ${{ env.REGISTRY }}
64+
if: github.event_name != 'pull_request'
65+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
66+
with:
67+
registry: ${{ env.REGISTRY }}
68+
username: ${{ github.actor }}
69+
password: ${{ secrets.GITHUB_TOKEN }}
70+
71+
- name: Extract Docker metadata
72+
id: meta
73+
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f
74+
with:
75+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
76+
tags: |
77+
type=raw,value=${{ env.VERSION_FOR_TAG }}
78+
type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
79+
flavor: |
80+
latest=false
81+
82+
- name: Build and push Docker image
83+
id: build-and-push
84+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
85+
with:
86+
context: images/bitcoind
87+
push: ${{ github.event_name != 'pull_request' }}
88+
build-args: |
89+
VERSION=${{ env.VERSION_FOR_GIT }}
90+
tags: ${{ steps.meta.outputs.tags }}
91+
labels: ${{ steps.meta.outputs.labels }}
92+
cache-from: type=gha
93+
cache-to: type=gha,mode=max
94+
95+
- name: Sign the published Docker image
96+
if: ${{ github.event_name != 'pull_request' }}
97+
env:
98+
TAGS: ${{ steps.meta.outputs.tags }}
99+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
100+
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
101+
102+
- name: Verify ghcr image signatures
103+
if: ${{ github.event_name != 'pull_request' }}
104+
shell: bash
105+
env:
106+
COSIGN_EXPERIMENTAL: 1
107+
TAGS: ${{ steps.meta.outputs.tags }}
108+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
109+
run: |
110+
echo "${TAGS}" | xargs -I {} cosign verify \
111+
--certificate-identity=https://github.com/${{ github.repository }}/.github/workflows/release-bitcoind.yml@${{ github.ref }} \
112+
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
113+
"{}@${DIGEST}"
114+
115+
generate-provenance:
116+
needs: [build]
117+
if: github.event_name != 'pull_request'
118+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
119+
with:
120+
image: ghcr.io/${{ github.repository }}/bitcoind
121+
digest: ${{ needs.build.outputs.digest }}
122+
registry-username: ${{ github.actor }}
123+
secrets:
124+
registry-password: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release-dogecoind.yml‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
name: Release dogecoind image
2+
on:
3+
push:
4+
branches: ["main"]
5+
tags: ["*"]
6+
paths: ["images/dogecoind/**"]
7+
pull_request:
8+
branches: ["main"]
9+
paths: ["images/dogecoind/**"]
10+
env:
11+
REGISTRY: ghcr.io
12+
IMAGE_NAME: ${{ github.repository }}/dogecoind
13+
permissions: read-all
14+
jobs:
15+
build:
16+
runs-on: ubuntu-latest
17+
outputs:
18+
digest: ${{ steps.build-and-push.outputs.digest }}
19+
permissions:
20+
contents: read
21+
packages: write
22+
id-token: write
23+
steps:
24+
- name: Checkout repository
25+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
26+
- name: Get image tag
27+
id: get_image_tag
28+
run: |
29+
VERSION=$(grep "^ARG VERSION=" images/dogecoind/Dockerfile \
30+
| cut -d'=' -f2 \
31+
| tr -d '"' \
32+
| tr -d "'" \
33+
| tr -d [:space:])
34+
echo $VERSION
35+
echo "image_tag=${VERSION}" >> $GITHUB_OUTPUT
36+
- name: Install cosign
37+
if: github.event_name != 'pull_request'
38+
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad
39+
with:
40+
cosign-release: "v2.5.3"
41+
- name: Set up Docker Buildx
42+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
43+
- name: Log into registry ${{ env.REGISTRY }}
44+
if: github.event_name != 'pull_request'
45+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
46+
with:
47+
registry: ${{ env.REGISTRY }}
48+
username: ${{ github.actor }}
49+
password: ${{ secrets.GITHUB_TOKEN }}
50+
- name: Extract Docker metadata
51+
id: meta
52+
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f
53+
with:
54+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
55+
tags: |
56+
type=semver,pattern={{version}},value=${{ steps.get_image_tag.outputs.image_tag }},enable=${{ github.event_name == 'push' && startsWith(github.ref, 'refs/heads/') }}
57+
type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
58+
type=ref,event=tag,enable=${{ startsWith(github.ref, 'refs/tags/') }}
59+
flavor: |
60+
latest=false
61+
- name: Build and push Docker image
62+
id: build-and-push
63+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
64+
with:
65+
context: images/dogecoind
66+
push: ${{ github.event_name != 'pull_request' }}
67+
tags: ${{ steps.meta.outputs.tags }}
68+
labels: ${{ steps.meta.outputs.labels }}
69+
cache-from: type=gha
70+
cache-to: type=gha,mode=max
71+
- name: Sign the published Docker image
72+
if: ${{ github.event_name != 'pull_request' }}
73+
env:
74+
TAGS: ${{ steps.meta.outputs.tags }}
75+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
76+
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
77+
- name: Verify ghcr image signatures
78+
if: ${{ github.event_name != 'pull_request' }}
79+
shell: bash
80+
env:
81+
COSIGN_EXPERIMENTAL: 1
82+
TAGS: ${{ steps.meta.outputs.tags }}
83+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
84+
run: |
85+
echo "${TAGS}" | xargs -I {} cosign verify \
86+
--certificate-identity=https://github.com/${{ github.repository }}/.github/workflows/release-dogecoind.yml@${{ github.ref }} \
87+
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
88+
"{}@${DIGEST}"
89+
generate-provenance:
90+
needs: [build]
91+
if: github.event_name != 'pull_request'
92+
permissions:
93+
actions: read
94+
id-token: write
95+
packages: write
96+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
97+
with:
98+
image: ghcr.io/${{ github.repository }}/dogecoind
99+
digest: ${{ needs.build.outputs.digest }}
100+
registry-username: ${{ github.actor }}
101+
secrets:
102+
registry-password: ${{ secrets.GITHUB_TOKEN }}
103+

‎.github/workflows/release-rippled.yml‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
name: Release rippled image
2+
on:
3+
push:
4+
branches: ["main"]
5+
tags: ["*"]
6+
paths: ["images/rippled/**"]
7+
pull_request:
8+
branches: ["main"]
9+
paths: ["images/rippled/**"]
10+
env:
11+
REGISTRY: ghcr.io
12+
IMAGE_NAME: ${{ github.repository }}/rippled
13+
permissions: read-all
14+
jobs:
15+
build:
16+
runs-on: ubuntu-latest
17+
outputs:
18+
digest: ${{ steps.build-and-push.outputs.digest }}
19+
permissions:
20+
contents: read
21+
packages: write
22+
id-token: write
23+
steps:
24+
- name: Checkout repository
25+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
26+
- name: Get image tag
27+
id: get_image_tag
28+
run: |
29+
VERSION=$(grep "^ARG VERSION=" images/rippled/Dockerfile \
30+
| cut -d'=' -f2 \
31+
| tr -d '"' \
32+
| tr -d "'" \
33+
| tr -d [:space:])
34+
echo $VERSION
35+
echo "image_tag=${VERSION}" >> $GITHUB_OUTPUT
36+
- name: Install cosign
37+
if: github.event_name != 'pull_request'
38+
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad
39+
with:
40+
cosign-release: "v2.5.3"
41+
- name: Set up Docker Buildx
42+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
43+
- name: Log into registry ${{ env.REGISTRY }}
44+
if: github.event_name != 'pull_request'
45+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
46+
with:
47+
registry: ${{ env.REGISTRY }}
48+
username: ${{ github.actor }}
49+
password: ${{ secrets.GITHUB_TOKEN }}
50+
- name: Extract Docker metadata
51+
id: meta
52+
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f
53+
with:
54+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
55+
tags: |
56+
type=semver,pattern={{version}},value=${{ steps.get_image_tag.outputs.image_tag }},enable=${{ github.event_name == 'push' && startsWith(github.ref, 'refs/heads/') }}
57+
type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
58+
type=ref,event=tag,enable=${{ startsWith(github.ref, 'refs/tags/') }}
59+
flavor: |
60+
latest=false
61+
- name: Build and push Docker image
62+
id: build-and-push
63+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
64+
with:
65+
context: images/rippled
66+
push: ${{ github.event_name != 'pull_request' }}
67+
tags: ${{ steps.meta.outputs.tags }}
68+
labels: ${{ steps.meta.outputs.labels }}
69+
cache-from: type=gha
70+
cache-to: type=gha,mode=max
71+
- name: Sign the published Docker image
72+
if: ${{ github.event_name != 'pull_request' }}
73+
env:
74+
TAGS: ${{ steps.meta.outputs.tags }}
75+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
76+
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
77+
- name: Verify ghcr image signatures
78+
if: ${{ github.event_name != 'pull_request' }}
79+
shell: bash
80+
env:
81+
COSIGN_EXPERIMENTAL: 1
82+
TAGS: ${{ steps.meta.outputs.tags }}
83+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
84+
run: |
85+
echo "${TAGS}" | xargs -I {} cosign verify \
86+
--certificate-identity=https://github.com/${{ github.repository }}/.github/workflows/release-rippled.yml@${{ github.ref }} \
87+
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
88+
"{}@${DIGEST}"
89+
generate-provenance:
90+
needs: [build]
91+
if: github.event_name != 'pull_request'
92+
permissions:
93+
actions: read
94+
id-token: write
95+
packages: write
96+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
97+
with:
98+
image: ghcr.io/${{ github.repository }}/rippled
99+
registry-username: ${{ github.actor }}
100+
digest: ${{ needs.build.outputs.digest }}
101+
secrets:
102+
registry-password: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)