Skip to content

Commit 8bf734f

Browse files
vidbregar-flarevidbregar-flare
committed
add build pipelines for bitcoin, dogecoin and xrpl
1 parent b74d93c commit 8bf734f

File tree

4 files changed

+196
-0
lines changed

4 files changed

+196
-0
lines changed

‎.github/workflows/release-bitcoind.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Release bitcoind image
2+
on:
3+
push:
4+
branches: [main]
5+
paths: ["images/bitcoind/**"]
6+
pull_request:
7+
branches: [main]
8+
paths: ["images/bitcoind/**"]
9+
10+
jobs:
11+
call:
12+
uses: ./.github/workflows/release-image.yml
13+
with:
14+
image: ghcr.io/${{ github.repository }}/bitcoind
15+
context: images/bitcoind
16+
dockerfile: Dockerfile
17+
secrets:
18+
registry-password: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release-dogecoind.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Release dogecoind image
2+
on:
3+
push:
4+
branches: [main]
5+
paths: ["images/dogecoind/**"]
6+
pull_request:
7+
branches: [main]
8+
paths: ["images/dogecoind/**"]
9+
10+
jobs:
11+
call:
12+
uses: ./.github/workflows/release-image.yml
13+
with:
14+
image: ghcr.io/${{ github.repository }}/dogecoind
15+
context: images/dogecoind
16+
dockerfile: Dockerfile
17+
secrets:
18+
registry-password: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release-image.yml‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
on:
2+
workflow_call:
3+
inputs:
4+
image:
5+
required: true
6+
type: string
7+
context:
8+
required: true
9+
type: string
10+
dockerfile:
11+
required: false
12+
type: string
13+
default: Dockerfile
14+
secrets:
15+
registry-password:
16+
required: true
17+
18+
permissions:
19+
contents: read
20+
packages: write
21+
id-token: write
22+
23+
jobs:
24+
build:
25+
runs-on: ubuntu-latest
26+
permissions:
27+
contents: read
28+
packages: write
29+
id-token: write
30+
outputs:
31+
digest: ${{ steps.build-and-push.outputs.digest }}
32+
tags: ${{ steps.meta.outputs.tags }}
33+
steps:
34+
- name: Checkout
35+
uses: actions/checkout@v4
36+
37+
- name: Get image tag (from Dockerfile ARG VERSION)
38+
id: get_image_tag
39+
run: |
40+
if [[ "${{ github.event_name }}" == "push" && "${{ github.ref }}" == "refs/heads/main" ]]; then
41+
IMAGE_TAG=$(RAW_VERSION=$(grep -m1 '^ARG VERSION=' "${{ inputs.context }}/${{ inputs.dockerfile }}" \
42+
| cut -d'=' -f2 | tr -d '"' | tr -d "'" | tr -d '[:space:]')
43+
else
44+
# Use short commit SHA for Pull Requests
45+
IMAGE_TAG=$(echo ${{ github.sha }} | cut -c1-7)
46+
fi
47+
echo "Using image tag: $IMAGE_TAG"
48+
echo "IMAGE_TAG=${IMAGE_TAG}" >> $GITHUB_ENV
49+
50+
- name: Install cosign
51+
if: github.event_name != 'pull_request'
52+
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad
53+
with:
54+
cosign-release: "v2.5.3"
55+
56+
- name: Setup Buildx
57+
uses: docker/setup-buildx-action@v2
58+
59+
- name: Login to registry
60+
if: github.event_name != 'pull_request'
61+
uses: docker/login-action@v2
62+
with:
63+
registry: ghcr.io
64+
username: ${{ github.actor }}
65+
password: ${{ secrets.registry-password }}
66+
67+
- name: Extract Docker metadata
68+
id: meta
69+
uses: docker/metadata-action@v4
70+
with:
71+
images: ${{ inputs.image }}
72+
tags: |
73+
type=raw,value=${{ env.IMAGE_TAG }}
74+
type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
75+
76+
- name: Build and push
77+
id: build-and-push
78+
uses: docker/build-push-action@v4
79+
with:
80+
context: ${{ inputs.context }}
81+
file: ${{ inputs.context }}/${{ inputs.dockerfile }}
82+
push: ${{ github.event_name != 'pull_request' }}
83+
tags: ${{ steps.meta.outputs.tags }}
84+
labels: ${{ steps.meta.outputs.labels }}
85+
cache-from: type=gha
86+
cache-to: type=gha,mode=max
87+
88+
- name: Sign published image (keyless / certificate-based)
89+
if: ${{ github.event_name != 'pull_request' }}
90+
env:
91+
COSIGN_EXPERIMENTAL: 1
92+
TAGS: ${{ steps.meta.outputs.tags }}
93+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
94+
run: |
95+
echo "${TAGS}" | xargs -n1 -I {} cosign sign --yes {}@${DIGEST}
96+
97+
- name: Verify signatures
98+
if: ${{ github.event_name != 'pull_request' }}
99+
env:
100+
COSIGN_EXPERIMENTAL: 1
101+
TAGS: ${{ steps.meta.outputs.tags }}
102+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
103+
run: |
104+
echo "${TAGS}" | while read -r tag; do
105+
cosign verify \
106+
--certificate-identity="https://github.com/${{ github.repository }}/.github/workflows/release-image.yml@${{ github.ref }}" \
107+
--certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
108+
"${tag}@${DIGEST}"
109+
done
110+
111+
# - name: Sign the published Docker image
112+
# if: ${{ github.event_name != 'pull_request' }}
113+
# env:
114+
# TAGS: ${{ steps.meta.outputs.tags }}
115+
# DIGEST: ${{ steps.build-and-push.outputs.digest }}
116+
# run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
117+
# - name: Verify ghcr image signatures
118+
# if: ${{ github.event_name != 'pull_request' }}
119+
# shell: bash
120+
# env:
121+
# COSIGN_EXPERIMENTAL: 1
122+
# TAGS: ${{ steps.meta.outputs.tags }}
123+
# DIGEST: ${{ steps.build-and-push.outputs.digest }}
124+
# run: |
125+
# echo "${TAGS}" | xargs -I {} cosign verify \
126+
# --certificate-identity=https://github.com/${{ github.repository }}/.github/workflows/release-dogecoind.yml@${{ github.ref }} \
127+
# --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
128+
# "{}@${DIGEST}"
129+
generate-provenance:
130+
needs: [build]
131+
if: ${{ github.event_name != 'pull_request' }}
132+
permissions:
133+
actions: read
134+
id-token: write
135+
packages: write
136+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
137+
with:
138+
image: ${{ inputs.image }}
139+
digest: ${{ needs.build.outputs.digest }}
140+
registry-username: ${{ github.actor }}
141+
secrets:
142+
registry-password: ${{ secrets.registry-password }}

‎.github/workflows/release-rippled.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Release rippled image
2+
on:
3+
push:
4+
branches: [main]
5+
paths: ["images/rippled/**"]
6+
pull_request:
7+
branches: [main]
8+
paths: ["images/rippled/**"]
9+
10+
jobs:
11+
call:
12+
uses: ./.github/workflows/release-image.yml
13+
with:
14+
image: ghcr.io/${{ github.repository }}/rippled
15+
context: images/rippled
16+
dockerfile: Dockerfile
17+
secrets:
18+
registry-password: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)