Skip to content

Commit f7e9206

Browse files
vidbregar-flarevidbregar-flare
authored
Merge pull request #76 from flare-foundation/add-build-pipelines
add build pipelines for bitcoin, dogecoin and xrpl
2 parents b74d93c + 6dd3714 commit f7e9206

File tree

5 files changed

+196
-1
lines changed

5 files changed

+196
-1
lines changed

‎.github/workflows/release-bitcoind.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Release bitcoind image
2+
on:
3+
push:
4+
branches: [main]
5+
paths: ["images/bitcoind/**"]
6+
pull_request:
7+
branches: [main]
8+
paths: ["images/bitcoind/**"]
9+
10+
jobs:
11+
call:
12+
uses: ./.github/workflows/release-image.yml
13+
with:
14+
image: ghcr.io/${{ github.repository }}/bitcoind
15+
context: images/bitcoind
16+
dockerfile: Dockerfile
17+
secrets:
18+
registry-password: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release-dogecoind.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Release dogecoind image
2+
on:
3+
push:
4+
branches: [main]
5+
paths: ["images/dogecoind/**"]
6+
pull_request:
7+
branches: [main]
8+
paths: ["images/dogecoind/**"]
9+
10+
jobs:
11+
call:
12+
uses: ./.github/workflows/release-image.yml
13+
with:
14+
image: ghcr.io/${{ github.repository }}/dogecoind
15+
context: images/dogecoind
16+
dockerfile: Dockerfile
17+
secrets:
18+
registry-password: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release-image.yml‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
on:
2+
workflow_call:
3+
inputs:
4+
image:
5+
required: true
6+
type: string
7+
context:
8+
required: true
9+
type: string
10+
dockerfile:
11+
required: false
12+
type: string
13+
default: Dockerfile
14+
secrets:
15+
registry-password:
16+
required: true
17+
18+
permissions:
19+
contents: read
20+
packages: write
21+
id-token: write
22+
23+
jobs:
24+
build:
25+
runs-on: ubuntu-latest
26+
permissions:
27+
contents: read
28+
packages: write
29+
id-token: write
30+
outputs:
31+
digest: ${{ steps.build-and-push.outputs.digest }}
32+
tags: ${{ steps.meta.outputs.tags }}
33+
steps:
34+
- name: Checkout
35+
uses: actions/checkout@v4
36+
37+
- name: Get image tag (from Dockerfile ARG VERSION)
38+
id: get_image_tag
39+
run: |
40+
if [[ "${{ github.event_name }}" == "push" && "${{ github.ref }}" == "refs/heads/main" ]]; then
41+
IMAGE_TAG=$(grep -m1 '^ARG VERSION=' "${{ inputs.context }}/${{ inputs.dockerfile }}" \
42+
| cut -d'=' -f2 | tr -d '"' | tr -d "'" | tr -d '[:space:]')
43+
else
44+
IMAGE_TAG=$(echo ${{ github.sha }} | cut -c1-7)
45+
fi
46+
echo "Using image tag: $IMAGE_TAG"
47+
echo "IMAGE_TAG=${IMAGE_TAG}" >> $GITHUB_ENV
48+
49+
- name: Install cosign
50+
if: github.event_name != 'pull_request'
51+
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad
52+
with:
53+
cosign-release: "v2.5.3"
54+
55+
- name: Setup Buildx
56+
uses: docker/setup-buildx-action@v2
57+
58+
- name: Login to registry
59+
if: github.event_name != 'pull_request'
60+
uses: docker/login-action@v2
61+
with:
62+
registry: ghcr.io
63+
username: ${{ github.actor }}
64+
password: ${{ secrets.registry-password }}
65+
66+
- name: Extract Docker metadata
67+
id: meta
68+
uses: docker/metadata-action@v4
69+
with:
70+
images: ${{ inputs.image }}
71+
tags: |
72+
type=raw,value=${{ env.IMAGE_TAG }}
73+
type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
74+
75+
- name: Build and push
76+
id: build-and-push
77+
uses: docker/build-push-action@v4
78+
with:
79+
context: ${{ inputs.context }}
80+
file: ${{ inputs.context }}/${{ inputs.dockerfile }}
81+
push: true
82+
tags: ${{ steps.meta.outputs.tags }}
83+
labels: ${{ steps.meta.outputs.labels }}
84+
cache-from: type=gha
85+
cache-to: type=gha,mode=max
86+
87+
- name: Sign published image (keyless / certificate-based)
88+
if: ${{ github.event_name != 'pull_request' }}
89+
env:
90+
COSIGN_EXPERIMENTAL: 1
91+
TAGS: ${{ steps.meta.outputs.tags }}
92+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
93+
run: |
94+
echo "${TAGS}" | xargs -n1 -I {} cosign sign --yes {}@${DIGEST}
95+
96+
- name: Verify signatures
97+
if: ${{ github.event_name != 'pull_request' }}
98+
env:
99+
COSIGN_EXPERIMENTAL: 1
100+
TAGS: ${{ steps.meta.outputs.tags }}
101+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
102+
run: |
103+
echo "${TAGS}" | while read -r tag; do
104+
cosign verify \
105+
--certificate-identity="https://github.com/${{ github.repository }}/.github/workflows/release-image.yml@${{ github.ref }}" \
106+
--certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
107+
"${tag}@${DIGEST}"
108+
done
109+
110+
# - name: Sign the published Docker image
111+
# if: ${{ github.event_name != 'pull_request' }}
112+
# env:
113+
# TAGS: ${{ steps.meta.outputs.tags }}
114+
# DIGEST: ${{ steps.build-and-push.outputs.digest }}
115+
# run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
116+
# - name: Verify ghcr image signatures
117+
# if: ${{ github.event_name != 'pull_request' }}
118+
# shell: bash
119+
# env:
120+
# COSIGN_EXPERIMENTAL: 1
121+
# TAGS: ${{ steps.meta.outputs.tags }}
122+
# DIGEST: ${{ steps.build-and-push.outputs.digest }}
123+
# run: |
124+
# echo "${TAGS}" | xargs -I {} cosign verify \
125+
# --certificate-identity=https://github.com/${{ github.repository }}/.github/workflows/release-dogecoind.yml@${{ github.ref }} \
126+
# --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
127+
# "{}@${DIGEST}"
128+
generate-provenance:
129+
needs: [build]
130+
if: ${{ github.event_name != 'pull_request' }}
131+
permissions:
132+
actions: read
133+
id-token: write
134+
packages: write
135+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
136+
with:
137+
image: ${{ inputs.image }}
138+
digest: ${{ needs.build.outputs.digest }}
139+
registry-username: ${{ github.actor }}
140+
secrets:
141+
registry-password: ${{ secrets.registry-password }}

‎.github/workflows/release-rippled.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Release rippled image
2+
on:
3+
push:
4+
branches: [main]
5+
paths: ["images/rippled/**"]
6+
pull_request:
7+
branches: [main]
8+
paths: ["images/rippled/**"]
9+
10+
jobs:
11+
call:
12+
uses: ./.github/workflows/release-image.yml
13+
with:
14+
image: ghcr.io/${{ github.repository }}/rippled
15+
context: images/rippled
16+
dockerfile: Dockerfile
17+
secrets:
18+
registry-password: ${{ secrets.GITHUB_TOKEN }}

‎images/rippled/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# syntax=docker/dockerfile:1.3-labs
22
FROM debian:trixie@sha256:0d01188e8dd0ac63bf155900fad49279131a876a1ea7fac917c62e87ccb2732d as build
33

4-
ARG VERSION=3.0.0
4+
ARG VERSION=3.1.0
55

66
ENV DEBIAN_FRONTEND="noninteractive" TZ="Europe/London"
77

0 commit comments

Comments
 (0)