Merge pull request #1683 from flavio/fix-go-wasi-policies #213
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build, Sign, and Generate SBOM, Attestation & Provenance | |
| on: | |
| workflow_call: | |
| inputs: | |
| version: | |
| type: string | |
| push: | |
| branches: | |
| - "main" | |
| - "feat-**" | |
| jobs: | |
| build: | |
| strategy: | |
| matrix: | |
| component: [policy-server, kubewarden-controller, audit-scanner] | |
| arch: [amd64, arm64] | |
| include: | |
| - arch: amd64 | |
| runner: ubuntu-latest | |
| platform: linux/amd64 | |
| - arch: arm64 | |
| runner: ubuntu-24.04-arm | |
| platform: linux/arm64 | |
| permissions: | |
| packages: write # Pushing images to ghcr.io | |
| id-token: write # Signing images with cosign | |
| runs-on: ${{ matrix.runner }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Build, sign, and upload digest | |
| uses: kubewarden/github-actions/container-build@63e6bff6226bbdd84a4244892417eb27676b7a8c # v5.0.1 | |
| with: | |
| component: ${{ matrix.component }} | |
| arch: ${{ matrix.arch }} | |
| platform: ${{ matrix.platform }} | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| merge: | |
| runs-on: ubuntu-latest | |
| needs: [build] | |
| permissions: | |
| packages: write # Pushing multi-arch manifest to ghcr.io | |
| id-token: write # Signing images with cosign | |
| strategy: | |
| matrix: | |
| component: [policy-server, kubewarden-controller, audit-scanner] | |
| steps: | |
| - name: Retrieve tag name (main) | |
| if: ${{ startsWith(github.ref, 'refs/heads/main') }} | |
| run: | | |
| echo TAG_NAME=latest >> $GITHUB_ENV | |
| - name: Retrieve tag name (feat branch) | |
| if: ${{ startsWith(github.ref, 'refs/heads/feat') }} | |
| run: | | |
| echo "TAG_NAME=latest-$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_ENV | |
| - name: Retrieve tag name (release) | |
| if: ${{ !startsWith(github.ref, 'refs/heads/') }} | |
| env: | |
| INPUT_VERSION: ${{ inputs.version }} | |
| run: | | |
| echo TAG_NAME=$INPUT_VERSION >> $GITHUB_ENV | |
| - name: Merge multi-arch images | |
| uses: kubewarden/github-actions/merge-multiarch@63e6bff6226bbdd84a4244892417eb27676b7a8c # v5.0.1 | |
| with: | |
| component: ${{ matrix.component }} | |
| tag: ${{ env.TAG_NAME }} | |
| arch: amd64,arm64 | |
| github-token: ${{ secrets.GITHUB_TOKEN }} |