Skip to content

Commit f5d9dfc

Browse files
fl-matic-rupnikfl-matic-rupnik
committed
Squash merge mr/optimization into main
1 parent 052d22f commit f5d9dfc

File tree

4 files changed

+161
-292
lines changed

4 files changed

+161
-292
lines changed

‎.github/workflows/release-bitcoind.yml‎

Lines changed: 6 additions & 111 deletions
Original file line numberDiff line numberDiff line change
@@ -1,124 +1,19 @@
11
name: Release bitcoind image
2-
32
on:
43
push:
5-
branches: ["main"]
4+
branches: [main, "mr/optimization"]
65
tags: ["*"]
76
paths: ["images/bitcoind/**"]
87
pull_request:
9-
branches: ["main"]
8+
branches: [main]
109
paths: ["images/bitcoind/**"]
1110

12-
env:
13-
REGISTRY: ghcr.io
14-
IMAGE_NAME: ${{ github.repository }}/bitcoind
15-
16-
permissions:
17-
contents: read
18-
id-token: write
19-
packages: write
20-
actions: read
21-
2211
jobs:
23-
build:
24-
runs-on: ubuntu-latest
25-
permissions:
26-
contents: read
27-
packages: write
28-
id-token: write
29-
outputs:
30-
image: ${{ steps.meta.outputs.tags }}
31-
digest: ${{ steps.build-and-push.outputs.digest }}
32-
33-
steps:
34-
- name: Checkout repository
35-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
36-
37-
- name: Get image tag (strip leading v only for tag)
38-
id: get_image_tag
39-
run: |
40-
RAW_VERSION=$(grep "^ARG VERSION=" images/bitcoind/Dockerfile \
41-
| cut -d'=' -f2 \
42-
| tr -d '"' \
43-
| tr -d "'" \
44-
| tr -d '[:space:]')
45-
46-
VERSION_FOR_GIT=$RAW_VERSION
47-
VERSION_FOR_TAG=${RAW_VERSION#v}
48-
49-
echo "VERSION_FOR_GIT=${VERSION_FOR_GIT}" >> $GITHUB_ENV
50-
echo "VERSION_FOR_TAG=${VERSION_FOR_TAG}" >> $GITHUB_ENV
51-
52-
echo "image_tag=${VERSION_FOR_TAG}" >> $GITHUB_OUTPUT
53-
54-
- name: Install cosign
55-
if: github.event_name != 'pull_request'
56-
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad
57-
with:
58-
cosign-release: "v2.5.3"
59-
60-
- name: Set up Docker Buildx
61-
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
62-
63-
- name: Log into registry ${{ env.REGISTRY }}
64-
if: github.event_name != 'pull_request'
65-
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
66-
with:
67-
registry: ${{ env.REGISTRY }}
68-
username: ${{ github.actor }}
69-
password: ${{ secrets.GITHUB_TOKEN }}
70-
71-
- name: Extract Docker metadata
72-
id: meta
73-
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f
74-
with:
75-
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
76-
tags: |
77-
type=raw,value=${{ env.VERSION_FOR_TAG }}
78-
type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
79-
flavor: |
80-
latest=false
81-
82-
- name: Build and push Docker image
83-
id: build-and-push
84-
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
85-
with:
86-
context: images/bitcoind
87-
push: ${{ github.event_name != 'pull_request' }}
88-
build-args: |
89-
VERSION=${{ env.VERSION_FOR_GIT }}
90-
tags: ${{ steps.meta.outputs.tags }}
91-
labels: ${{ steps.meta.outputs.labels }}
92-
cache-from: type=gha
93-
cache-to: type=gha,mode=max
94-
95-
- name: Sign the published Docker image
96-
if: ${{ github.event_name != 'pull_request' }}
97-
env:
98-
TAGS: ${{ steps.meta.outputs.tags }}
99-
DIGEST: ${{ steps.build-and-push.outputs.digest }}
100-
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
101-
102-
- name: Verify ghcr image signatures
103-
if: ${{ github.event_name != 'pull_request' }}
104-
shell: bash
105-
env:
106-
COSIGN_EXPERIMENTAL: 1
107-
TAGS: ${{ steps.meta.outputs.tags }}
108-
DIGEST: ${{ steps.build-and-push.outputs.digest }}
109-
run: |
110-
echo "${TAGS}" | xargs -I {} cosign verify \
111-
--certificate-identity=https://github.com/${{ github.repository }}/.github/workflows/release-bitcoind.yml@${{ github.ref }} \
112-
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
113-
"{}@${DIGEST}"
114-
115-
generate-provenance:
116-
needs: [build]
117-
if: github.event_name != 'pull_request'
118-
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
12+
call:
13+
uses: ./.github/workflows/release-image.yml
11914
with:
12015
image: ghcr.io/${{ github.repository }}/bitcoind
121-
digest: ${{ needs.build.outputs.digest }}
122-
registry-username: ${{ github.actor }}
16+
context: images/bitcoind
17+
dockerfile: Dockerfile
12318
secrets:
12419
registry-password: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release-dogecoind.yml‎

Lines changed: 7 additions & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -1,103 +1,19 @@
11
name: Release dogecoind image
22
on:
33
push:
4-
branches: ["main"]
4+
branches: [main, "mr/optimization"]
55
tags: ["*"]
66
paths: ["images/dogecoind/**"]
77
pull_request:
8-
branches: ["main"]
8+
branches: [main]
99
paths: ["images/dogecoind/**"]
10-
env:
11-
REGISTRY: ghcr.io
12-
IMAGE_NAME: ${{ github.repository }}/dogecoind
13-
permissions: read-all
10+
1411
jobs:
15-
build:
16-
runs-on: ubuntu-latest
17-
outputs:
18-
digest: ${{ steps.build-and-push.outputs.digest }}
19-
permissions:
20-
contents: read
21-
packages: write
22-
id-token: write
23-
steps:
24-
- name: Checkout repository
25-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
26-
- name: Get image tag
27-
id: get_image_tag
28-
run: |
29-
VERSION=$(grep "^ARG VERSION=" images/dogecoind/Dockerfile \
30-
| cut -d'=' -f2 \
31-
| tr -d '"' \
32-
| tr -d "'" \
33-
| tr -d [:space:])
34-
echo $VERSION
35-
echo "image_tag=${VERSION}" >> $GITHUB_OUTPUT
36-
- name: Install cosign
37-
if: github.event_name != 'pull_request'
38-
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad
39-
with:
40-
cosign-release: "v2.5.3"
41-
- name: Set up Docker Buildx
42-
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435
43-
- name: Log into registry ${{ env.REGISTRY }}
44-
if: github.event_name != 'pull_request'
45-
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
46-
with:
47-
registry: ${{ env.REGISTRY }}
48-
username: ${{ github.actor }}
49-
password: ${{ secrets.GITHUB_TOKEN }}
50-
- name: Extract Docker metadata
51-
id: meta
52-
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f
53-
with:
54-
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
55-
tags: |
56-
type=semver,pattern={{version}},value=${{ steps.get_image_tag.outputs.image_tag }},enable=${{ github.event_name == 'push' && startsWith(github.ref, 'refs/heads/') }}
57-
type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
58-
type=ref,event=tag,enable=${{ startsWith(github.ref, 'refs/tags/') }}
59-
flavor: |
60-
latest=false
61-
- name: Build and push Docker image
62-
id: build-and-push
63-
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83
64-
with:
65-
context: images/dogecoind
66-
push: ${{ github.event_name != 'pull_request' }}
67-
tags: ${{ steps.meta.outputs.tags }}
68-
labels: ${{ steps.meta.outputs.labels }}
69-
cache-from: type=gha
70-
cache-to: type=gha,mode=max
71-
- name: Sign the published Docker image
72-
if: ${{ github.event_name != 'pull_request' }}
73-
env:
74-
TAGS: ${{ steps.meta.outputs.tags }}
75-
DIGEST: ${{ steps.build-and-push.outputs.digest }}
76-
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
77-
- name: Verify ghcr image signatures
78-
if: ${{ github.event_name != 'pull_request' }}
79-
shell: bash
80-
env:
81-
COSIGN_EXPERIMENTAL: 1
82-
TAGS: ${{ steps.meta.outputs.tags }}
83-
DIGEST: ${{ steps.build-and-push.outputs.digest }}
84-
run: |
85-
echo "${TAGS}" | xargs -I {} cosign verify \
86-
--certificate-identity=https://github.com/${{ github.repository }}/.github/workflows/release-dogecoind.yml@${{ github.ref }} \
87-
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
88-
"{}@${DIGEST}"
89-
generate-provenance:
90-
needs: [build]
91-
if: github.event_name != 'pull_request'
92-
permissions:
93-
actions: read
94-
id-token: write
95-
packages: write
96-
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
12+
call:
13+
uses: ./.github/workflows/release-image.yml
9714
with:
9815
image: ghcr.io/${{ github.repository }}/dogecoind
99-
digest: ${{ needs.build.outputs.digest }}
100-
registry-username: ${{ github.actor }}
16+
context: images/dogecoind
17+
dockerfile: Dockerfile
10118
secrets:
10219
registry-password: ${{ secrets.GITHUB_TOKEN }}
103-

‎.github/workflows/release-image.yml‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
on:
2+
workflow_call:
3+
inputs:
4+
image:
5+
required: true
6+
type: string
7+
context:
8+
required: true
9+
type: string
10+
dockerfile:
11+
required: false
12+
type: string
13+
default: Dockerfile
14+
secrets:
15+
registry-password:
16+
required: true
17+
18+
permissions:
19+
contents: read
20+
packages: write
21+
id-token: write
22+
23+
jobs:
24+
build:
25+
runs-on: ubuntu-latest
26+
permissions:
27+
contents: read
28+
packages: write
29+
id-token: write
30+
outputs:
31+
digest: ${{ steps.build-and-push.outputs.digest }}
32+
tags: ${{ steps.meta.outputs.tags }}
33+
steps:
34+
- name: Checkout
35+
uses: actions/checkout@v4
36+
37+
- name: Get image tag (from Dockerfile ARG VERSION)
38+
id: get_image_tag
39+
run: |
40+
grep '^ARG VERSION=' "${{ inputs.context }}/$GITHUB_WORKFLOW" >/dev/null 2>&1 || true
41+
RAW_VERSION=$(grep -m1 '^ARG VERSION=' "${{ inputs.context }}/${{ inputs.dockerfile }}" \
42+
| cut -d'=' -f2 | tr -d '"' | tr -d "'" | tr -d '[:space:]')
43+
VERSION_FOR_TAG=${RAW_VERSION#v}
44+
echo "image_tag=${VERSION_FOR_TAG}" >> $GITHUB_OUTPUT
45+
echo "VERSION_FOR_GIT=${RAW_VERSION}" >> $GITHUB_ENV
46+
echo "VERSION_FOR_TAG=${VERSION_FOR_TAG}" >> $GITHUB_ENV
47+
48+
- name: Install cosign
49+
if: github.event_name != 'pull_request'
50+
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad
51+
with:
52+
cosign-release: "v2.5.3"
53+
54+
- name: Setup Buildx
55+
uses: docker/setup-buildx-action@v2
56+
57+
- name: Login to registry
58+
if: github.event_name != 'pull_request'
59+
uses: docker/login-action@v2
60+
with:
61+
registry: ghcr.io
62+
username: ${{ github.actor }}
63+
password: ${{ secrets.registry-password }}
64+
65+
- name: Extract Docker metadata
66+
id: meta
67+
uses: docker/metadata-action@v4
68+
with:
69+
images: ${{ inputs.image }}
70+
tags: |
71+
type=raw,value=${{ env.VERSION_FOR_TAG }}
72+
type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
73+
type=ref,event=tag,enable=${{ startsWith(github.ref, 'refs/tags/') }}
74+
75+
- name: Build and push
76+
id: build-and-push
77+
uses: docker/build-push-action@v4
78+
with:
79+
context: ${{ inputs.context }}
80+
file: ${{ inputs.context }}/${{ inputs.dockerfile }}
81+
push: ${{ github.event_name != 'pull_request' }}
82+
tags: ${{ steps.meta.outputs.tags }}
83+
labels: ${{ steps.meta.outputs.labels }}
84+
cache-from: type=gha
85+
cache-to: type=gha,mode=max
86+
87+
- name: Sign published image (keyless / certificate-based)
88+
if: ${{ github.event_name != 'pull_request' }}
89+
env:
90+
COSIGN_EXPERIMENTAL: 1
91+
TAGS: ${{ steps.meta.outputs.tags }}
92+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
93+
run: |
94+
echo "${TAGS}" | xargs -n1 -I {} cosign sign --yes {}@${DIGEST}
95+
96+
- name: Verify signatures
97+
if: ${{ github.event_name != 'pull_request' }}
98+
env:
99+
COSIGN_EXPERIMENTAL: 1
100+
TAGS: ${{ steps.meta.outputs.tags }}
101+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
102+
run: |
103+
echo "${TAGS}" | while read -r tag; do
104+
cosign verify \
105+
--certificate-identity="https://github.com/${{ github.repository }}/.github/workflows/release-image.yml@${{ github.ref }}" \
106+
--certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
107+
"${tag}@${DIGEST}"
108+
done
109+
110+
# - name: Sign the published Docker image
111+
# if: ${{ github.event_name != 'pull_request' }}
112+
# env:
113+
# TAGS: ${{ steps.meta.outputs.tags }}
114+
# DIGEST: ${{ steps.build-and-push.outputs.digest }}
115+
# run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
116+
# - name: Verify ghcr image signatures
117+
# if: ${{ github.event_name != 'pull_request' }}
118+
# shell: bash
119+
# env:
120+
# COSIGN_EXPERIMENTAL: 1
121+
# TAGS: ${{ steps.meta.outputs.tags }}
122+
# DIGEST: ${{ steps.build-and-push.outputs.digest }}
123+
# run: |
124+
# echo "${TAGS}" | xargs -I {} cosign verify \
125+
# --certificate-identity=https://github.com/${{ github.repository }}/.github/workflows/release-dogecoind.yml@${{ github.ref }} \
126+
# --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
127+
# "{}@${DIGEST}"
128+
generate-provenance:
129+
needs: [build]
130+
if: ${{ github.event_name != 'pull_request' }}
131+
permissions:
132+
actions: read
133+
id-token: write
134+
packages: write
135+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
136+
with:
137+
image: ${{ inputs.image }}
138+
digest: ${{ needs.build.outputs.digest }}
139+
registry-username: ${{ github.actor }}
140+
secrets:
141+
registry-password: ${{ secrets.registry-password }}

0 commit comments

Comments
 (0)