Skip to content

Commit 1a25437

Browse files
haadhaad
authored
Merge pull request #160 from nissessenap/mini_docker
Change to KO and attest container images
2 parents caf3dc4 + d8d09b9 commit 1a25437

4 files changed

Lines changed: 158 additions & 100 deletions

File tree

‎.github/workflows/docker-master.yaml‎

Lines changed: 50 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -6,51 +6,67 @@ on:
66

77
jobs:
88
build-and-push-docker-image:
9+
permissions:
10+
contents: read
11+
packages: write
12+
id-token: write
13+
914
name: Build Docker image and push to repositories with tag latest
1015
runs-on: ubuntu-latest
1116
steps:
1217
- name: Checkout code
1318
uses: actions/checkout@v5
1419

15-
- name: Set up QEMU
16-
uses: docker/setup-qemu-action@v3
17-
18-
- name: Set up Docker Buildx
19-
id: buildx
20-
uses: docker/setup-buildx-action@v3
21-
22-
- name: Docker meta
23-
id: meta
24-
uses: docker/metadata-action@v5
25-
with:
26-
images: |
27-
lablabs/cloudflare_exporter
28-
ghcr.io/lablabs/cloudflare_exporter
29-
# generate Docker tags based on the following events/attributes
30-
tags: type=raw,value=latest
31-
32-
- name: Login to DockerHub
33-
uses: docker/login-action@v3
34-
with:
35-
username: ${{ secrets.DOCKERHUB_USERNAME }}
36-
password: ${{ secrets.DOCKERHUB_TOKEN }}
37-
3820
- name: Login to Github Packages
3921
uses: docker/login-action@v3
4022
with:
4123
registry: ghcr.io
4224
username: ${{ github.repository_owner }}
4325
password: ${{ secrets.GITHUB_TOKEN }}
4426

45-
- name: Build image and push to Docker Hub and GitHub Container Registry
46-
uses: docker/build-push-action@v6
27+
28+
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
29+
with:
30+
go-version-file: "go.mod"
31+
cache: false
32+
33+
34+
- uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9
4735
with:
48-
context: .
49-
file: ./Dockerfile
50-
platforms: linux/amd64,linux/arm64
51-
tags: ${{ steps.meta.outputs.tags }}
52-
labels: ${{ steps.meta.outputs.labels }}
53-
push: true
54-
55-
- name: Image digest
56-
run: echo ${{ steps.docker_build.outputs.digest }}
36+
version: v0.18.0
37+
- name: Build and push
38+
id: publish-image
39+
env:
40+
KO_DOCKER_REPO: "ghcr.io/${{ github.repository }}"
41+
run: |
42+
ko build . --sbom=none --bare --platform linux/arm64,linux/amd64 -t latest \
43+
--image-label org.opencontainers.image.title=cloudflare-exporter \
44+
--image-label org.opencontainers.image.description="Prometheus CloudFlare Exporter" \
45+
--image-label org.opencontainers.image.url=${{ github.server_url }}/${{ github.repository }} \
46+
--image-label org.opencontainers.image.revision=${{ github.sha }} \
47+
--image-label org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }} \
48+
--image-label org.opencontainers.image.licenses=Apache-2.0 \
49+
--image-label org.opencontainers.image.version=latest \
50+
--image-label org.opencontainers.image.created="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
51+
52+
distribute-to-dockerhub:
53+
runs-on: ubuntu-latest
54+
needs:
55+
- build-and-push-docker-image
56+
permissions:
57+
packages: read
58+
steps:
59+
- name: Copy image to dockerhub
60+
env:
61+
GHCR_REPO: "ghcr.io/${{ github.repository }}"
62+
GHCR_USERNAME: ${{ github.actor }}
63+
GHCR_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
64+
DOCKER_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
65+
DOCKER_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
66+
run: |
67+
docker run --rm quay.io/containers/skopeo:v1.18.0 \
68+
copy --multi-arch all \
69+
--src-creds "$GHCR_USERNAME:$GHCR_PASSWORD" \
70+
--dest-creds "$DOCKER_USERNAME:$DOCKER_TOKEN" \
71+
docker://${GHCR_REPO}:latest \
72+
docker://lablabs/cloudflare_exporter:latest

‎.github/workflows/docker-release.yaml‎

Lines changed: 74 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -7,51 +7,91 @@ on:
77

88
jobs:
99
build-and-push-docker-image:
10+
permissions:
11+
contents: read
12+
packages: write
13+
id-token: write
14+
attestations: write
15+
1016
name: Build Docker image and push to repositories with version tag
1117
runs-on: ubuntu-latest
1218
steps:
1319
- name: Checkout code
1420
uses: actions/checkout@v5
1521

16-
- name: Set up QEMU
17-
uses: docker/setup-qemu-action@v3
18-
19-
- name: Set up Docker Buildx
20-
id: buildx
21-
uses: docker/setup-buildx-action@v3
22-
23-
- name: Docker meta
24-
id: meta
25-
uses: docker/metadata-action@v5
26-
with:
27-
images: |
28-
lablabs/cloudflare_exporter
29-
ghcr.io/lablabs/cloudflare_exporter
30-
# generate Docker tags based on the following events/attributes
31-
tags: type=ref,event=tag
32-
33-
- name: Login to DockerHub
34-
uses: docker/login-action@v3
35-
with:
36-
username: ${{ secrets.DOCKERHUB_USERNAME }}
37-
password: ${{ secrets.DOCKERHUB_TOKEN }}
38-
3922
- name: Login to Github Packages
4023
uses: docker/login-action@v3
4124
with:
4225
registry: ghcr.io
4326
username: ${{ github.repository_owner }}
4427
password: ${{ secrets.GITHUB_TOKEN }}
4528

46-
- name: Build image and push to Docker Hub and GitHub Container Registry
47-
uses: docker/build-push-action@v6
29+
30+
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
31+
with:
32+
go-version-file: "go.mod"
33+
cache: false
34+
35+
36+
- uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9
37+
with:
38+
version: v0.18.0
39+
- name: Build and push
40+
id: publish-image
41+
env:
42+
IMAGE_VERSION: ${{ github.ref_name }}
43+
KO_DOCKER_REPO: "ghcr.io/${{ github.repository }}"
44+
run: |
45+
ko build . --sbom=none --image-refs ./image-digest --bare --platform linux/arm64,linux/amd64 -t ${IMAGE_VERSION} \
46+
--image-label org.opencontainers.image.title=cloudflare-exporter \
47+
--image-label org.opencontainers.image.description="Prometheus CloudFlare Exporter" \
48+
--image-label org.opencontainers.image.url=${{ github.server_url }}/${{ github.repository }} \
49+
--image-label org.opencontainers.image.revision=${{ github.sha }} \
50+
--image-label org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }} \
51+
--image-label org.opencontainers.image.licenses=Apache-2.0 \
52+
--image-label org.opencontainers.image.version=${IMAGE_VERSION} \
53+
--image-label org.opencontainers.image.created="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
54+
55+
# Extract image digest from ko output
56+
# The file contains multiple lines (one per platform + manifest list at the end)
57+
# We need only the last line (manifest list) for attestation
58+
cat ./image-digest
59+
IMAGE_REF=$(head -n 1 ./image-digest)
60+
IMAGE_DIGEST=$(echo "$IMAGE_REF" | cut -d'@' -f2)
61+
62+
echo "Image reference: $IMAGE_REF"
63+
echo "Image digest: $IMAGE_DIGEST"
64+
65+
echo "digest=$IMAGE_DIGEST" >> "$GITHUB_OUTPUT"
66+
echo "image-ref=$IMAGE_REF" >> "$GITHUB_OUTPUT"
67+
68+
- name: Attest
69+
uses: actions/attest-build-provenance@v2
70+
id: attest
4871
with:
49-
context: .
50-
file: ./Dockerfile
51-
platforms: linux/amd64,linux/arm64
52-
tags: ${{ steps.meta.outputs.tags }}
53-
labels: ${{ steps.meta.outputs.labels }}
54-
push: true
55-
56-
- name: Image digest
57-
run: echo ${{ steps.docker_build.outputs.digest }}
72+
subject-name: ghcr.io/${{ github.repository }}
73+
subject-digest: ${{ steps.publish-image.outputs.digest }}
74+
push-to-registry: true
75+
76+
distribute-to-dockerhub:
77+
runs-on: ubuntu-latest
78+
needs:
79+
- build-and-push-docker-image
80+
permissions:
81+
packages: read
82+
steps:
83+
- name: Copy image to dockerhub
84+
env:
85+
IMAGE_VERSION: ${{ github.ref_name }}
86+
GHCR_REPO: "ghcr.io/${{ github.repository }}"
87+
GHCR_USERNAME: ${{ github.actor }}
88+
GHCR_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
89+
DOCKER_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
90+
DOCKER_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
91+
run: |
92+
docker run --rm quay.io/containers/skopeo:v1.18.0 \
93+
copy --multi-arch all \
94+
--src-creds "$GHCR_USERNAME:$GHCR_PASSWORD" \
95+
--dest-creds "$DOCKER_USERNAME:$DOCKER_TOKEN" \
96+
docker://${GHCR_REPO}:${IMAGE_VERSION} \
97+
docker://lablabs/cloudflare_exporter:${IMAGE_VERSION}

‎Dockerfile‎

Lines changed: 0 additions & 24 deletions
This file was deleted.

0 commit comments

Comments
 (0)