chore(ci): update release workflow for multi distro

Author: YOU54F

script/.trivyignore

@@ -37,7 +37,13 @@ CVE-2019-16227
 CVE-2026-42217
 CVE-2026-24450
 CVE-2026-24660
+CVE-2026-57433
+CVE-2026-63970
+CVE-2026-64600
 # Debian high vulns
+CVE-2026-53399
+CVE-2026-64017
+CVE-2026-36849
 CVE-2013-7445
 CVE-2019-16226
 CVE-2019-16228

script/release-workflow/docker-build.sh

@@ -5,16 +5,14 @@ set -euo >/dev/null
 ## This will allow for local use for testing or scanning with trivy (multi-manifest builds cannot be imported)
 ## we will build a multi-manifest build during ./docker-push.sh
 ARCHES=${ARCHES:-'amd64'}
-
-DEBIAN=${IS_DEBIAN:+"-debian"}
-
+: "${IS_DEBIAN:=}"
 DOCKER_IMAGE_ORG_AND_NAME="${DOCKER_REPOSITORY:-pactfoundation}/pact-broker"
 for arch in $ARCHES; do 
     docker buildx build \
     --platform linux/$arch \
     --build-arg VERSION="${TAG:-dev}" \
     --output type=docker \
-    --tag ${DOCKER_IMAGE_ORG_AND_NAME}:latest-${arch}${DEBIAN} \
+    --tag ${DOCKER_IMAGE_ORG_AND_NAME}:latest-${arch}${IS_DEBIAN:+"-debian"} \
     -f Dockerfile${IS_DEBIAN:+.debian} \
     .
 done

script/release-workflow/docker-push.sh

@@ -11,24 +11,26 @@ push() {
     --annotation "org.opencontainers.image.source=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" \
     --annotation "org.opencontainers.image.revision=$GITHUB_SHA" \
     --output=type=image,push=true \
-    -t ${DOCKER_IMAGE_ORG_AND_NAME}:$1 .
+    -t ${DOCKER_IMAGE_ORG_AND_NAME}:$1 \
+    -f Dockerfile${IS_DEBIAN:+.debian} .
+
 }
 push_ghcr() {
   docker buildx build --platform=linux/amd64,linux/arm64,linux/arm \
   --build-arg VERSION=${TAG} \
   --output=type=image,push=true \
-  -t ghcr.io/$(echo $DOCKER_IMAGE_ORG_AND_NAME | sed 's/pactfoundation/pact-foundation/g'):$1 .
+  -t ghcr.io/$(echo $DOCKER_IMAGE_ORG_AND_NAME | sed 's/pactfoundation/pact-foundation/g'):$1 \
+  -f Dockerfile${IS_DEBIAN:+.debian} .
 }
 
 if [ -n "${MAJOR_TAG:-}" ]; then
-  push ${MAJOR_TAG}
-  push_ghcr ${MAJOR_TAG}
+  push ${MAJOR_TAG}${DEBIAN}
+  push_ghcr ${MAJOR_TAG}${DEBIAN}
 fi
 
-push ${TAG}
-push_ghcr ${TAG}
-
+push ${TAG}${DEBIAN}
+push_ghcr ${TAG}${DEBIAN}
 if [ "${PUSH_TO_LATEST}" != "false" ]; then
-  push latest
-  push_ghcr latest
+  push latest${DEBIAN}
+  push_ghcr latest${DEBIAN}
 fi

script/release-workflow/docker-scan.sh

@@ -5,5 +5,4 @@ set -euo >/dev/null
 script_dir=$(cd "$(dirname $0)" && pwd)
 
 ARCH=${ARCH:-'amd64'}
-DEBIAN=${IS_DEBIAN:+"-debian"}
-${script_dir}/../scan.sh ${DOCKER_IMAGE_ORG_AND_NAME}:latest-${ARCH}${DEBIAN}
+${script_dir}/../scan.sh ${DOCKER_IMAGE_ORG_AND_NAME}:latest-${ARCH}${IS_DEBIAN:+"-debian"}

script/release-workflow/image-scan.sh

@@ -5,5 +5,4 @@ set -euo >/dev/null
 script_dir=$(cd "$(dirname $0)" && pwd)
 
 ARCH=${ARCH:-'amd64'}
-IS_DEBIAN=${IS_DEBIAN:+"-debian"}
-trivy image ${DOCKER_IMAGE_ORG_AND_NAME}:latest-${ARCH}${IS_DEBIAN} --severity HIGH,CRITICAL --exit-code 1 --ignorefile ${script_dir}/../.trivyignore
+trivy image ${DOCKER_IMAGE_ORG_AND_NAME}:latest-${ARCH}${IS_DEBIAN:+"-debian"} --severity HIGH,CRITICAL --exit-code 1 --ignorefile ${script_dir}/../.trivyignore

script/release-workflow/run.sh

@@ -1,6 +1,7 @@
 #!/bin/sh
 
 set -euo >/dev/null
+: "${IS_DEBIAN:=}"
 
 workflow_dir=$(cd "$(dirname $0)" && pwd)
 
@@ -15,6 +16,13 @@ ${workflow_dir}/validate.sh
 ${workflow_dir}/docker-prepare.sh
 ${workflow_dir}/docker-build.sh
 ${workflow_dir}/docker-scan.sh
-${workflow_dir}/prepare-release.sh
+
+# skip release prep and git push on the debian workflow to avoid 
+# overwriting
+if [ -z "${IS_DEBIAN}" ]; then
+  ${workflow_dir}/prepare-release.sh
+fi
 ${workflow_dir}/docker-push.sh
-${workflow_dir}/git-push.sh
+if [ -z "${IS_DEBIAN}" ]; then
+  ${workflow_dir}/git-push.sh
+fi

script/release-workflow/set-env-vars.sh

@@ -15,6 +15,11 @@ else
     export ARCH=amd64
 fi
 
+: "${IS_DEBIAN:=}"
+export IS_DEBIAN=$IS_DEBIAN
+export DEBIAN=${IS_DEBIAN:+"-debian"}
+echo "IS_DEBIAN=$IS_DEBIAN"
+
 if [ -z "$TAG" ]; then
   if [ -n "$VERSION" ] && [ -z "$INCREMENT" ]; then
     echo "If VERSION is specified, then INCREMENT must also be specified"
@@ -27,11 +32,9 @@ if [ -z "$TAG" ]; then
     export VERSION=$(bundle exec bump show-next $INCREMENT)
   fi
 
-  DEBIAN=${IS_DEBIAN:+"-debian"}
-
   export PACT_BROKER_VERSION=$(grep "pact_broker (" pact_broker/Gemfile.lock | awk -F '[()]' '{print $2}')
-  export TAG="$VERSION-pactbroker${PACT_BROKER_VERSION}${DEBIAN}"
-  export MAJOR_TAG="$(echo $VERSION | cut -d'.' -f1)${DEBIAN}"
+  export TAG="$VERSION-pactbroker${PACT_BROKER_VERSION}"
+  export MAJOR_TAG="$(echo $VERSION | cut -d'.' -f1)"
 
   echo "INCREMENT=$INCREMENT"
   echo "VERSION=$VERSION"

script/scan-inside-docker-container.sh

@@ -2,4 +2,4 @@
 set -eu
 
 wget -q -O - https://raw.githubusercontent.com/aquasecurity/trivy/master/contrib/install.sh | sh -s -- -b /usr/local/bin
-trivy filesystem --exit-code 1 --no-progress /
+trivy filesystem --exit-code 1 --severity HIGH,CRITICAL --no-progress /

script/test.sh

@@ -3,6 +3,7 @@
 set -e
 
 : "${TAG:?TAG must be provided}"
+: "${IS_DEBIAN:=}"
 DEBIAN=${IS_DEBIAN:+"-debian"}
 
 docker_compose_files=$(find . -name "docker-compose-test*.yml")