Bump CNI Plugins to v1.9.1 (#14) #43
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - v?* | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Prepare | |
| id: prep | |
| run: | | |
| # If this is a git tag, use the tag name as a docker tag | |
| if [[ $GITHUB_REF == refs/tags/v?* ]]; then | |
| registry=quay.io | |
| name="$GITHUB_REPOSITORY" | |
| tag="${GITHUB_REF#refs/tags/v}" | |
| tag="${tag//+/-}" | |
| else | |
| registry=ttl.sh | |
| name="${GITHUB_REPOSITORY//\//-}-$GITHUB_SHA-$GITHUB_RUN_ID" | |
| tag=1d | |
| fi | |
| { | |
| echo registry="$registry" | |
| echo name="$name" | |
| echo tag="$tag" | |
| } >>"$GITHUB_OUTPUT" | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 | |
| with: | |
| platforms: amd64,arm64,arm,riscv64 | |
| - name: Set up Docker Buildx | |
| id: buildx | |
| uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0 | |
| - name: Build OCI image archive | |
| id: build | |
| uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0 | |
| with: | |
| builder: ${{ steps.buildx.outputs.name }} | |
| platforms: linux/amd64,linux/arm64,linux/arm,linux/riscv64 | |
| tags: ${{ format('{0}/{1}:{2}', steps.prep.outputs.registry, steps.prep.outputs.name, steps.prep.outputs.tag) }} | |
| outputs: type=oci,dest=oci-image.tar | |
| - name: Compress OCI image archive | |
| # Pre-compress the image archive so that the upload-artifact action | |
| # doesn't try to do it. The layers inside the tar archive are themselves | |
| # already gzip compressed, so this is not for size reduction, but solely | |
| # to prevent the very slow compression process in the upload-artifact | |
| # action. | |
| # See: https://github.com/actions/upload-artifact/issues/199 | |
| # See: https://github.com/actions/toolkit/blob/6c1f9eaae833355a0b212b66c5f2e3ac366de185/packages/artifact/src/internal/upload-gzip.ts#L11-L33 | |
| # Might be fixed when upload-artifact@v4 gets released: https://github.com/actions/toolkit/pull/1488 | |
| run: zstdmt --fast oci-image.tar | |
| - name: Upload OCI image archive | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| with: | |
| name: oci-image.tar.zst | |
| path: oci-image.tar.zst | |
| - name: Extract OCI image archive | |
| run: mkdir image && tar xf oci-image.tar.zst -C image/ | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| input: image/ | |
| format: table | |
| list-all-pkgs: "true" # Flags a warning, but prints out stuff nevertheless | |
| exit-code: "1" | |
| - name: Log in to registry | |
| if: steps.prep.outputs.registry != 'ttl.sh' | |
| uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1.7 | |
| with: | |
| username: ${{ secrets.DOCKER_USERNAME }} | |
| password: ${{ secrets.DOCKER_PASSWORD }} | |
| registry: ${{ steps.prep.outputs.registry }} | |
| - name: Upload OCI image to registry | |
| env: | |
| REGISTRY: ${{ steps.prep.outputs.registry }} | |
| NAME: ${{ steps.prep.outputs.name }} | |
| TAG: ${{ steps.prep.outputs.tag }} | |
| run: | | |
| podmanArgs=(-v "$(realpath oci-image.tar):/image.tar:ro") | |
| skopeoArgs=(--multi-arch all --preserve-digests) | |
| if [ -e "$REGISTRY_AUTH_FILE" ]; then | |
| podmanArgs+=(-v "$REGISTRY_AUTH_FILE:/auth.json:ro") | |
| skopeoArgs+=(--authfile=/auth.json) | |
| fi | |
| set -x | |
| podman run "${podmanArgs[@]}" \ | |
| docker://quay.io/skopeo/stable:v1.18.0 copy "${skopeoArgs[@]}" \ | |
| oci-archive:/image.tar "docker://$REGISTRY/$NAME:$TAG" |