Skip to content

Commit 4658a51

Browse files
vidbregar-flarevidbregar-flare
committed
add build pipelines for bitcoin, dogecoin and xrpl
1 parent b74d93c commit 4658a51

File tree

5 files changed

+195
-0
lines changed

5 files changed

+195
-0
lines changed

‎.github/workflows/release-bitcoind.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Release bitcoind image
2+
on:
3+
push:
4+
branches: [main]
5+
paths: ["images/bitcoind/**"]
6+
pull_request:
7+
branches: [main]
8+
paths: ["images/bitcoind/**"]
9+
10+
jobs:
11+
call:
12+
uses: ./.github/workflows/release-image.yml
13+
with:
14+
image: ghcr.io/${{ github.repository }}/bitcoind
15+
context: images/bitcoind
16+
dockerfile: Dockerfile
17+
secrets:
18+
registry-password: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release-dogecoind.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Release dogecoind image
2+
on:
3+
push:
4+
branches: [main]
5+
paths: ["images/dogecoind/**"]
6+
pull_request:
7+
branches: [main]
8+
paths: ["images/dogecoind/**"]
9+
10+
jobs:
11+
call:
12+
uses: ./.github/workflows/release-image.yml
13+
with:
14+
image: ghcr.io/${{ github.repository }}/dogecoind
15+
context: images/dogecoind
16+
dockerfile: Dockerfile
17+
secrets:
18+
registry-password: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release-image.yml‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
on:
2+
workflow_call:
3+
inputs:
4+
image:
5+
required: true
6+
type: string
7+
context:
8+
required: true
9+
type: string
10+
dockerfile:
11+
required: false
12+
type: string
13+
default: Dockerfile
14+
secrets:
15+
registry-password:
16+
required: true
17+
18+
permissions:
19+
contents: read
20+
packages: write
21+
id-token: write
22+
23+
jobs:
24+
build:
25+
runs-on: ubuntu-latest
26+
permissions:
27+
contents: read
28+
packages: write
29+
id-token: write
30+
outputs:
31+
digest: ${{ steps.build-and-push.outputs.digest }}
32+
tags: ${{ steps.meta.outputs.tags }}
33+
steps:
34+
- name: Checkout
35+
uses: actions/checkout@v4
36+
37+
- name: Get image tag (from Dockerfile ARG VERSION)
38+
id: get_image_tag
39+
run: |
40+
if [[ "${{ github.event_name }}" == "push" && "${{ github.ref }}" == "refs/heads/main" ]]; then
41+
IMAGE_TAG=$(grep -m1 '^ARG VERSION=' "${{ inputs.context }}/${{ inputs.dockerfile }}" \
42+
| cut -d'=' -f2 | tr -d '"' | tr -d "'" | tr -d '[:space:]')
43+
else
44+
IMAGE_TAG=$(echo ${{ github.sha }} | cut -c1-7)
45+
fi
46+
echo "Using image tag: $IMAGE_TAG"
47+
echo "IMAGE_TAG=${IMAGE_TAG}" >> $GITHUB_ENV
48+
49+
- name: Install cosign
50+
if: github.event_name != 'pull_request'
51+
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad
52+
with:
53+
cosign-release: "v2.5.3"
54+
55+
- name: Setup Buildx
56+
uses: docker/setup-buildx-action@v2
57+
58+
- name: Login to registry
59+
if: github.event_name != 'pull_request'
60+
uses: docker/login-action@v2
61+
with:
62+
registry: ghcr.io
63+
username: ${{ github.actor }}
64+
password: ${{ secrets.registry-password }}
65+
66+
- name: Extract Docker metadata
67+
id: meta
68+
uses: docker/metadata-action@v4
69+
with:
70+
images: ${{ inputs.image }}
71+
tags: |
72+
type=raw,value=${{ env.IMAGE_TAG }}
73+
type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
74+
75+
- name: Build and push
76+
id: build-and-push
77+
uses: docker/build-push-action@v4
78+
with:
79+
context: ${{ inputs.context }}
80+
file: ${{ inputs.context }}/${{ inputs.dockerfile }}
81+
tags: ${{ steps.meta.outputs.tags }}
82+
labels: ${{ steps.meta.outputs.labels }}
83+
cache-from: type=gha
84+
cache-to: type=gha,mode=max
85+
86+
- name: Sign published image (keyless / certificate-based)
87+
if: ${{ github.event_name != 'pull_request' }}
88+
env:
89+
COSIGN_EXPERIMENTAL: 1
90+
TAGS: ${{ steps.meta.outputs.tags }}
91+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
92+
run: |
93+
echo "${TAGS}" | xargs -n1 -I {} cosign sign --yes {}@${DIGEST}
94+
95+
- name: Verify signatures
96+
if: ${{ github.event_name != 'pull_request' }}
97+
env:
98+
COSIGN_EXPERIMENTAL: 1
99+
TAGS: ${{ steps.meta.outputs.tags }}
100+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
101+
run: |
102+
echo "${TAGS}" | while read -r tag; do
103+
cosign verify \
104+
--certificate-identity="https://github.com/${{ github.repository }}/.github/workflows/release-image.yml@${{ github.ref }}" \
105+
--certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
106+
"${tag}@${DIGEST}"
107+
done
108+
109+
# - name: Sign the published Docker image
110+
# if: ${{ github.event_name != 'pull_request' }}
111+
# env:
112+
# TAGS: ${{ steps.meta.outputs.tags }}
113+
# DIGEST: ${{ steps.build-and-push.outputs.digest }}
114+
# run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
115+
# - name: Verify ghcr image signatures
116+
# if: ${{ github.event_name != 'pull_request' }}
117+
# shell: bash
118+
# env:
119+
# COSIGN_EXPERIMENTAL: 1
120+
# TAGS: ${{ steps.meta.outputs.tags }}
121+
# DIGEST: ${{ steps.build-and-push.outputs.digest }}
122+
# run: |
123+
# echo "${TAGS}" | xargs -I {} cosign verify \
124+
# --certificate-identity=https://github.com/${{ github.repository }}/.github/workflows/release-dogecoind.yml@${{ github.ref }} \
125+
# --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
126+
# "{}@${DIGEST}"
127+
generate-provenance:
128+
needs: [build]
129+
if: ${{ github.event_name != 'pull_request' }}
130+
permissions:
131+
actions: read
132+
id-token: write
133+
packages: write
134+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
135+
with:
136+
image: ${{ inputs.image }}
137+
digest: ${{ needs.build.outputs.digest }}
138+
registry-username: ${{ github.actor }}
139+
secrets:
140+
registry-password: ${{ secrets.registry-password }}

‎.github/workflows/release-rippled.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Release rippled image
2+
on:
3+
push:
4+
branches: [main]
5+
paths: ["images/rippled/**"]
6+
pull_request:
7+
branches: [main]
8+
paths: ["images/rippled/**"]
9+
10+
jobs:
11+
call:
12+
uses: ./.github/workflows/release-image.yml
13+
with:
14+
image: ghcr.io/${{ github.repository }}/rippled
15+
context: images/rippled
16+
dockerfile: Dockerfile
17+
secrets:
18+
registry-password: ${{ secrets.GITHUB_TOKEN }}

‎images/bitcoind/Dockerfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ FROM debian:bookworm@sha256:93492d1405a072c9d3b89110490e330e0b7eb37754cafc952090
33

44
ARG VERSION=v30.0
55

6+
67
ENV DEBIAN_FRONTEND="noninteractive" TZ="Europe/London"
78

89
# https://github.com/bitcoin/bitcoin/blob/master/doc/build-unix.md#linux-distribution-specific-instructions

0 commit comments

Comments
 (0)