logging-operator/.github/workflows/config-reloader.yaml at master · kube-logging/logging-operator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
name: Config reloader

on:
  workflow_call:
    inputs:
      publish:
        description: Publish artifacts to the artifact store
        default: false
        required: false
        type: boolean

permissions:
  contents: read

jobs:
  config-reloader-image:
    name: Config reloader image
    runs-on: ubuntu-latest

    permissions:
      contents: read
      packages: write
      id-token: write
      security-events: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Set up QEMU
        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0

      - name: Set up Cosign
        uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
        if: ${{ inputs.publish }}

      - name: Set image name
        id: image-name
        run: echo "value=ghcr.io/${{ github.repository }}/config-reloader" >> "$GITHUB_OUTPUT"

      - name: Gather build metadata
        id: meta
        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
        with:
          images: ${{ steps.image-name.outputs.value }}
          flavor: |
            latest = false
          tags: |
            type=ref,event=branch
            type=ref,event=pr
            type=semver,pattern={{raw}}
            type=raw,value=latest,enable={{is_default_branch}}
          labels: |
            org.opencontainers.image.description=Config reloader image for the Logging operator.
            org.opencontainers.image.title=Logging operator Config reloader image
            org.opencontainers.image.authors=Kube logging authors
            org.opencontainers.image.documentation=https://kube-logging.dev/docs/

      - name: Login to GitHub Container Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ github.token }}
        if: ${{ inputs.publish }}

      - name: Build and push config-reloader image
        id: build
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
        with:
          context: images/config-reloader
          platforms: linux/amd64,linux/arm64
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max
          outputs: |
            type=image,push=${{ inputs.publish }},name=target,annotation-index.org.opencontainers.image.description=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.description'] }}
            type=oci,dest=image.tar,name=target,annotation-index.org.opencontainers.image.description=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.description'] }}

      - name: Sign image with GitHub OIDC Token
        if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
          TAGS: ${{ steps.meta.outputs.tags }}
        run: |
          images=""
          for tag in ${TAGS[@]}; do
            images+="${tag}@${DIGEST} "
          done

          cosign sign --yes --rekor-url "https://rekor.sigstore.dev/" ${images}

      - name: Verify signed image with cosign
        if: ${{ inputs.publish && github.repository_owner == 'kube-logging' }} # Check if the workflow is called by the same GitHub organization
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
          TAGS: ${{ steps.meta.outputs.tags }}
        run: |
          for tag in ${TAGS[@]}; do
            cosign verify "${tag}@${DIGEST}" \
              --rekor-url "https://rekor.sigstore.dev/" \
              --certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/config-reloader.yaml@${{ github.ref }}" \
              --certificate-oidc-issuer "https://token.actions.githubusercontent.com" | jq
          done

      - name: Extract OCI tarball
        run: |
          mkdir -p image
          tar -xf image.tar -C image

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        env:
          TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2,ghcr.io/aquasecurity/trivy-db:2,mirror.gcr.io/aquasec/trivy-db:2
          TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1,ghcr.io/aquasecurity/trivy-java-db:1,mirror.gcr.io/aquasec/trivy-java-db:1
        with:
          input: image
          format: sarif
          output: trivy-results.sarif

      - name: Upload Trivy scan results as artifact
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: "[${{ github.job }}] Trivy scan results"
          path: trivy-results.sarif
          retention-days: 5

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.11
        with:
          sarif_file: trivy-results.sarif