feat(just): use uupd for system upgrades #773
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| paths-ignore: | |
| - "**.md" | |
| merge_group: | |
| workflow_dispatch: | |
| env: | |
| IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }} | |
| IMAGE_NAME: common | |
| jobs: | |
| build_push: | |
| name: Build and push image | |
| runs-on: ubuntu-26.04 | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.1 | |
| with: | |
| submodules: recursive | |
| - name: Generate tags | |
| id: generate-tags | |
| shell: bash | |
| run: | | |
| echo "sha_short=${GITHUB_SHA::7}" >> $GITHUB_OUTPUT | |
| alias_tags=() | |
| # Only perform the follow code when the action is spawned from a Pull Request | |
| if [[ "${{ github.event_name }}" == "pull_request" ]]; then | |
| alias_tags+=("pr-${{ github.event.number }}") | |
| else | |
| # The following is run when the timer is triggered or a merge/push to main | |
| echo "date=$(date +%Y%m%d)" >> $GITHUB_OUTPUT | |
| alias_tags+=("latest") | |
| fi | |
| echo "alias_tags=${alias_tags[*]}" >> $GITHUB_OUTPUT | |
| - name: Build Image | |
| id: build_image | |
| uses: redhat-actions/buildah-build@061ffd31bb5c3f8733a6f9bbdf00a9fb02eb708c | |
| with: | |
| containerfiles: | | |
| ./Containerfile | |
| image: ${{ env.IMAGE_NAME }} | |
| tags: | | |
| ${{ steps.generate-tags.outputs.alias_tags }} | |
| ${{ steps.generate-tags.outputs.date }} | |
| ${{ steps.generate-tags.outputs.sha_short }} | |
| oci: true | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| if: github.event_name != 'pull_request' | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # Push the image to GHCR (Image Registry) | |
| - name: Push To GHCR | |
| uses: redhat-actions/push-to-registry@3916dcf329473955be3059ef62c9c062ea1b9054 | |
| id: push | |
| if: github.event_name != 'pull_request' | |
| env: | |
| REGISTRY_USER: ${{ github.actor }} | |
| REGISTRY_PASSWORD: ${{ github.token }} | |
| with: | |
| image: ${{ steps.build_image.outputs.image }} | |
| tags: ${{ steps.build_image.outputs.tags }} | |
| registry: ${{ env.IMAGE_REGISTRY }} | |
| username: ${{ env.REGISTRY_USER }} | |
| password: ${{ env.REGISTRY_PASSWORD }} | |
| extra-args: | | |
| --compression-format=zstd | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| if: github.event_name != 'pull_request' | |
| with: | |
| # be careful when upgrading major versions | |
| cosign-release: 'v3.1.2' | |
| - name: Sign container image | |
| if: github.event_name != 'pull_request' | |
| run: | | |
| # Sign with both OIDC and static key so we have compatibility with both | |
| # https://github.com/containers/container-libs/issues/388 | |
| # https://github.com/coreos/rpm-ostree/issues/5509 | |
| cosign sign -y ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${TAGS} | |
| # use old bundle format, so we can use newer cosign 3.X.X instead of 2.X.X | |
| cosign sign -y --new-bundle-format=false --use-signing-config=false --key env://COSIGN_PRIVATE_KEY ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${TAGS} | |
| env: | |
| TAGS: ${{ steps.push.outputs.digest }} | |
| COSIGN_EXPERIMENTAL: false | |
| COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} |