Skip to content

Commit 19a863a

Browse files
klemenfnklemenfn
authored
Merge branch 'main' into dependabot/github_actions/actions/upload-artifact-6.0.0
2 parents 7786b0d + 01dc746 commit 19a863a

File tree

5 files changed

+192
-1
lines changed

5 files changed

+192
-1
lines changed

‎.github/workflows/release-bitcoind.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Release bitcoind image
2+
on:
3+
push:
4+
branches: [main]
5+
paths: ["images/bitcoind/**"]
6+
pull_request:
7+
branches: [main]
8+
paths: ["images/bitcoind/**"]
9+
10+
jobs:
11+
call:
12+
uses: ./.github/workflows/release-image.yml
13+
with:
14+
image: ghcr.io/${{ github.repository }}/bitcoind
15+
context: images/bitcoind
16+
dockerfile: Dockerfile
17+
secrets:
18+
registry-password: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release-dogecoind.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Release dogecoind image
2+
on:
3+
push:
4+
branches: [main]
5+
paths: ["images/dogecoind/**"]
6+
pull_request:
7+
branches: [main]
8+
paths: ["images/dogecoind/**"]
9+
10+
jobs:
11+
call:
12+
uses: ./.github/workflows/release-image.yml
13+
with:
14+
image: ghcr.io/${{ github.repository }}/dogecoind
15+
context: images/dogecoind
16+
dockerfile: Dockerfile
17+
secrets:
18+
registry-password: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release-image.yml‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
on:
2+
workflow_call:
3+
inputs:
4+
image:
5+
required: true
6+
type: string
7+
context:
8+
required: true
9+
type: string
10+
dockerfile:
11+
required: false
12+
type: string
13+
default: Dockerfile
14+
secrets:
15+
registry-password:
16+
required: true
17+
18+
permissions: read-all
19+
20+
jobs:
21+
build:
22+
runs-on: ubuntu-latest
23+
permissions:
24+
contents: read
25+
packages: write
26+
id-token: write
27+
outputs:
28+
digest: ${{ steps.build-and-push.outputs.digest }}
29+
tags: ${{ steps.meta.outputs.tags }}
30+
steps:
31+
- name: Checkout
32+
uses: actions/checkout@v4
33+
34+
- name: Get image tag (from Dockerfile ARG VERSION)
35+
id: get_image_tag
36+
run: |
37+
if [[ "${{ github.event_name }}" == "push" && "${{ github.ref }}" == "refs/heads/main" ]]; then
38+
IMAGE_TAG=$(grep -m1 '^ARG VERSION=' "${{ inputs.context }}/${{ inputs.dockerfile }}" \
39+
| cut -d'=' -f2 | tr -d '"' | tr -d "'" | tr -d '[:space:]')
40+
else
41+
IMAGE_TAG=$(echo ${{ github.sha }} | cut -c1-7)
42+
fi
43+
echo "Using image tag: $IMAGE_TAG"
44+
echo "IMAGE_TAG=${IMAGE_TAG}" >> $GITHUB_ENV
45+
46+
- name: Install cosign
47+
if: github.event_name != 'pull_request'
48+
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad
49+
with:
50+
cosign-release: "v2.5.3"
51+
52+
- name: Setup Buildx
53+
uses: docker/setup-buildx-action@v2
54+
55+
- name: Login to registry
56+
uses: docker/login-action@v2
57+
with:
58+
registry: ghcr.io
59+
username: ${{ github.actor }}
60+
password: ${{ secrets.registry-password }}
61+
62+
- name: Extract Docker metadata
63+
id: meta
64+
uses: docker/metadata-action@v4
65+
with:
66+
images: ${{ inputs.image }}
67+
tags: |
68+
type=raw,value=${{ env.IMAGE_TAG }}
69+
type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
70+
71+
- name: Build and push
72+
id: build-and-push
73+
uses: docker/build-push-action@v4
74+
with:
75+
context: ${{ inputs.context }}
76+
file: ${{ inputs.context }}/${{ inputs.dockerfile }}
77+
push: true
78+
tags: ${{ steps.meta.outputs.tags }}
79+
labels: ${{ steps.meta.outputs.labels }}
80+
cache-from: type=gha
81+
cache-to: type=gha,mode=max
82+
83+
- name: Sign published image (keyless / certificate-based)
84+
if: ${{ github.event_name != 'pull_request' }}
85+
env:
86+
COSIGN_EXPERIMENTAL: 1
87+
TAGS: ${{ steps.meta.outputs.tags }}
88+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
89+
run: |
90+
echo "${TAGS}" | xargs -n1 -I {} cosign sign --yes {}@${DIGEST}
91+
92+
- name: Verify signatures
93+
if: ${{ github.event_name != 'pull_request' }}
94+
env:
95+
COSIGN_EXPERIMENTAL: 1
96+
TAGS: ${{ steps.meta.outputs.tags }}
97+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
98+
run: |
99+
echo "${TAGS}" | while read -r tag; do
100+
cosign verify \
101+
--certificate-identity="https://github.com/${{ github.repository }}/.github/workflows/release-image.yml@${{ github.ref }}" \
102+
--certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
103+
"${tag}@${DIGEST}"
104+
done
105+
106+
# - name: Sign the published Docker image
107+
# if: ${{ github.event_name != 'pull_request' }}
108+
# env:
109+
# TAGS: ${{ steps.meta.outputs.tags }}
110+
# DIGEST: ${{ steps.build-and-push.outputs.digest }}
111+
# run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
112+
# - name: Verify ghcr image signatures
113+
# if: ${{ github.event_name != 'pull_request' }}
114+
# shell: bash
115+
# env:
116+
# COSIGN_EXPERIMENTAL: 1
117+
# TAGS: ${{ steps.meta.outputs.tags }}
118+
# DIGEST: ${{ steps.build-and-push.outputs.digest }}
119+
# run: |
120+
# echo "${TAGS}" | xargs -I {} cosign verify \
121+
# --certificate-identity=https://github.com/${{ github.repository }}/.github/workflows/release-dogecoind.yml@${{ github.ref }} \
122+
# --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
123+
# "{}@${DIGEST}"
124+
generate-provenance:
125+
needs: [build]
126+
if: ${{ github.event_name != 'pull_request' }}
127+
permissions:
128+
actions: read
129+
id-token: write
130+
packages: write
131+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
132+
with:
133+
image: ${{ inputs.image }}
134+
digest: ${{ needs.build.outputs.digest }}
135+
registry-username: ${{ github.actor }}
136+
secrets:
137+
registry-password: ${{ secrets.registry-password }}

‎.github/workflows/release-rippled.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Release rippled image
2+
on:
3+
push:
4+
branches: [main]
5+
paths: ["images/rippled/**"]
6+
pull_request:
7+
branches: [main]
8+
paths: ["images/rippled/**"]
9+
10+
jobs:
11+
call:
12+
uses: ./.github/workflows/release-image.yml
13+
with:
14+
image: ghcr.io/${{ github.repository }}/rippled
15+
context: images/rippled
16+
dockerfile: Dockerfile
17+
secrets:
18+
registry-password: ${{ secrets.GITHUB_TOKEN }}

‎images/rippled/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# syntax=docker/dockerfile:1.3-labs
22
FROM debian:trixie@sha256:0d01188e8dd0ac63bf155900fad49279131a876a1ea7fac917c62e87ccb2732d as build
33

4-
ARG VERSION=3.0.0
4+
ARG VERSION=3.1.0
55

66
ENV DEBIAN_FRONTEND="noninteractive" TZ="Europe/London"
77

0 commit comments

Comments
 (0)