forked from rancher/elemental-operator
-
Notifications
You must be signed in to change notification settings - Fork 0
110 lines (110 loc) · 4.23 KB
/
docker-master.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
name: Docker build and push on master
on:
push:
branches:
- main
env:
OPERATOR_REPO: quay.io/costoolkit/elemental-operator-ci
REGISTER_REPO: quay.io/costoolkit/elemental-register-ci
jobs:
docker:
runs-on: ubuntu-latest
permissions:
id-token: write # OIDC support.
contents: write
steps:
- name: Checkout code
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: cosign-installer
uses: sigstore/[email protected]
- name: Install the bom command
shell: bash
run: |
curl -L https://github.com/kubernetes-sigs/bom/releases/download/v0.3.0/bom-linux-amd64.tar.gz | tar xvz
sudo mv ./bom /usr/bin/bom
- name: Export tag
id: export_tag
run: |
git describe --abbrev=0 --tags
TAG=`git describe --abbrev=0 --tags 2>/dev/null || echo "v0.0.0"`
COMMITDATE=`date -d @$(git log -n1 --format="%at") "+%FT%TZ"`
echo "operator_tag=$TAG" >> $GITHUB_OUTPUT
echo "commit_date=$COMMITDATE" >> $GITHUB_OUTPUT
- name: Docker meta for operator master
id: meta-operator
uses: docker/[email protected]
with:
images: |
${{ env.OPERATOR_REPO }}
tags: |
type=sha,format=short,prefix=${{ steps.export_tag.outputs.operator_tag }}-
type=raw,value=latest
- name: Docker meta for register master
id: meta-register
uses: docker/[email protected]
with:
images: |
${{ env.REGISTER_REPO }}
tags: |
type=sha,format=short,prefix=${{ steps.export_tag.outputs.operator_tag }}-
type=raw,value=latest
- name: Set up Docker Buildx
id: buildx
uses: docker/[email protected]
- name: Login to Quay
uses: docker/[email protected]
with:
registry: quay.io
username: ${{ secrets.QUAY_USERNAME }}
password: ${{ secrets.QUAY_TOKEN }}
- name: Build operator image
uses: docker/[email protected]
with:
context: .
tags: ${{ steps.meta-operator.outputs.tags }}
labels: ${{ steps.meta-operator.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
target: elemental-operator
push: true
build-args: |
TAG=${{ steps.export_tag.outputs.operator_tag }}
COMMITDATE=${{ steps.export_tag.outputs.commit_date }}
COMMIT=${{ github.sha }}
- name: Build register image
uses: docker/[email protected]
with:
context: .
tags: ${{ steps.meta-register.outputs.tags }}
labels: ${{ steps.meta-register.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
target: elemental-register
push: true
build-args: |
TAG=${{ steps.export_tag.outputs.operator_tag }}
COMMITDATE=${{ steps.export_tag.outputs.commit_date }}
COMMIT=${{ github.sha }}
- name: Create SBOM file
shell: bash
run: |
bom generate -o elemental-operator.spdx .
bom generate -o elemental-register.spdx .
- name: Attach SBOM file in the container image
shell: bash
run: |
set -e
cosign attach sbom --sbom elemental-operator.spdx "${{ env.OPERATOR_REPO }}:${{ steps.export_tag.outputs.operator_tag }}-${GITHUB_SHA::7}"
cosign attach sbom --sbom elemental-operator.spdx "${{ env.OPERATOR_REPO }}:latest"
cosign attach sbom --sbom elemental-register.spdx "${{ env.REGISTER_REPO }}:${{ steps.export_tag.outputs.operator_tag }}-${GITHUB_SHA::7}"
cosign attach sbom --sbom elemental-register.spdx "${{ env.REGISTER_REPO }}:latest"
- name: Sign images
env:
COSIGN_EXPERIMENTAL: 1
run: |
cosign sign ${{ env.OPERATOR_REPO }}:${{ steps.export_tag.outputs.operator_tag }}-${GITHUB_SHA::7}
cosign sign ${{ env.OPERATOR_REPO }}:latest
cosign sign ${{ env.REGISTER_REPO }}:${{ steps.export_tag.outputs.operator_tag }}-${GITHUB_SHA::7}
cosign sign ${{ env.REGISTER_REPO }}:latest