mirror of
https://github.com/get-aurora-dev/iso.git
synced 2026-11-03 21:49:46 -09:00
add cosign and oras push to reusable build workflow
This commit is contained in:
Juha Uotila
parent
7ee7b870fc
commit
7a97e2fbcf
3 changed files with 108 additions and 4 deletions
5
.github/workflows/build-iso-stable.yml
vendored
5
.github/workflows/build-iso-stable.yml
vendored
|
|
@ -30,6 +30,11 @@ on:
|
|||
jobs:
|
||||
build-iso-stable:
|
||||
name: Build Stable ISOs
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
id-token: write
|
||||
attestations: write
|
||||
uses: ./.github/workflows/reusable-build-iso-anaconda.yml
|
||||
secrets: inherit
|
||||
with:
|
||||
|
|
|
|||
5
.github/workflows/build-iso-testing.yml
vendored
5
.github/workflows/build-iso-testing.yml
vendored
|
|
@ -32,6 +32,11 @@ on:
|
|||
jobs:
|
||||
build-iso-testing:
|
||||
name: Build Testing ISOs
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
id-token: write
|
||||
attestations: write
|
||||
uses: ./.github/workflows/reusable-build-iso-anaconda.yml
|
||||
secrets: inherit
|
||||
with:
|
||||
|
|
|
|||
102
.github/workflows/reusable-build-iso-anaconda.yml
vendored
102
.github/workflows/reusable-build-iso-anaconda.yml
vendored
|
|
@ -7,6 +7,10 @@ on:
|
|||
description: 'Upload ISOs as job artifacts'
|
||||
type: boolean
|
||||
default: false
|
||||
upload_ghcr:
|
||||
description: 'Upload ISOs to GitHub Container Registry (GHCR) via ORAS'
|
||||
type: boolean
|
||||
default: false
|
||||
upload_r2:
|
||||
description: 'Upload ISOs to Cloudflare R2'
|
||||
type: boolean
|
||||
|
|
@ -28,8 +32,6 @@ concurrency:
|
|||
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
|
||||
cancel-in-progress: true
|
||||
|
||||
permissions: {}
|
||||
|
||||
jobs:
|
||||
build:
|
||||
name: Build ISOs
|
||||
|
|
@ -42,7 +44,7 @@ jobs:
|
|||
image_version: ["${{ inputs.image_version }}"]
|
||||
permissions:
|
||||
contents: read
|
||||
packages: read
|
||||
packages: write
|
||||
id-token: write
|
||||
attestations: write
|
||||
|
||||
|
|
@ -58,6 +60,16 @@ jobs:
|
|||
run: |
|
||||
sudo ./.github/setup-runner-keys.sh
|
||||
|
||||
- name: Install Cosign
|
||||
if: inputs.upload_ghcr
|
||||
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
|
||||
with:
|
||||
cosign-release: 'v3.1.3'
|
||||
|
||||
- name: Install ORAS
|
||||
if: inputs.upload_ghcr
|
||||
uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
|
||||
|
||||
- name: Format image ref
|
||||
id: image_ref
|
||||
env:
|
||||
|
|
@ -135,7 +147,7 @@ jobs:
|
|||
|
||||
- name: Attestation
|
||||
uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
|
||||
if: inputs.upload_r2 || (inputs.upload_artifacts && github.event_name != 'pull_request')
|
||||
if: inputs.upload_r2 || (inputs.upload_artifacts && github.event_name != 'pull_request') || (inputs.upload_ghcr && github.event_name != 'pull_request')
|
||||
with:
|
||||
subject-path: ${{ steps.rename.outputs.output_directory }}/${{ steps.image_ref.outputs.artifact_format }}.iso
|
||||
|
||||
|
|
@ -155,6 +167,88 @@ jobs:
|
|||
path: ${{ steps.rename.outputs.output_directory }}/${{ steps.image_ref.outputs.artifact_format }}.iso-CHECKSUM
|
||||
archive: false
|
||||
|
||||
- name: Login to GitHub Container Registry
|
||||
if: inputs.upload_ghcr
|
||||
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Push ISO to GHCR via ORAS
|
||||
if: inputs.upload_ghcr
|
||||
id: push-ghcr
|
||||
env:
|
||||
OUTPUT_DIRECTORY: ${{ steps.rename.outputs.output_directory }}
|
||||
OUTPUT_NAME: ${{ steps.image_ref.outputs.artifact_format }}
|
||||
FLAVOR: ${{ matrix.flavor }}
|
||||
IMAGE_VERSION: ${{ matrix.image_version }}
|
||||
run: |
|
||||
set -eoux pipefail
|
||||
|
||||
if [[ "${FLAVOR}" =~ main ]]; then
|
||||
image_name="aurora"
|
||||
else
|
||||
image_name="aurora-${FLAVOR}"
|
||||
fi
|
||||
|
||||
GHCR_OWNER=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
|
||||
GHCR_REPO="ghcr.io/${GHCR_OWNER}/iso/${image_name}"
|
||||
ARCH="$(uname -m)"
|
||||
|
||||
alias_tags=()
|
||||
if [[ "${{ github.event_name }}" == "pull_request" ]]; then
|
||||
alias_tags+=("pr-${{ github.event.number }}-${IMAGE_VERSION}")
|
||||
alias_tags+=("pr-${{ github.event.number }}-${IMAGE_VERSION}-${ARCH}")
|
||||
alias_tags+=("pr-${{ github.event.number }}")
|
||||
alias_tags+=("pr-${{ github.event.number }}-${ARCH}")
|
||||
else
|
||||
alias_tags+=("${IMAGE_VERSION}")
|
||||
alias_tags+=("${IMAGE_VERSION}-${ARCH}")
|
||||
alias_tags+=("${IMAGE_VERSION}-$(date +%Y%m%d)")
|
||||
alias_tags+=("${GITHUB_SHA::7}")
|
||||
if [[ "${IMAGE_VERSION}" == "stable" ]]; then
|
||||
alias_tags+=("latest")
|
||||
alias_tags+=("latest-${ARCH}")
|
||||
fi
|
||||
fi
|
||||
|
||||
PRIMARY_TAG="${alias_tags[0]}"
|
||||
cd "${OUTPUT_DIRECTORY}"
|
||||
|
||||
echo "Pushing ${OUTPUT_NAME}.iso and ${OUTPUT_NAME}.iso-CHECKSUM to ${GHCR_REPO}:${PRIMARY_TAG}"
|
||||
oras push "${GHCR_REPO}:${PRIMARY_TAG}" "${OUTPUT_NAME}.iso" "${OUTPUT_NAME}.iso-CHECKSUM"
|
||||
|
||||
for tag in "${alias_tags[@]:1}"; do
|
||||
echo "Tagging ${GHCR_REPO}:${PRIMARY_TAG} as ${tag}"
|
||||
oras tag "${GHCR_REPO}:${PRIMARY_TAG}" "${tag}"
|
||||
done
|
||||
|
||||
DIGEST=$(oras resolve "${GHCR_REPO}:${PRIMARY_TAG}")
|
||||
echo "digest=${DIGEST}" >> "${GITHUB_OUTPUT}"
|
||||
echo "ghcr_repo=${GHCR_REPO}" >> "${GITHUB_OUTPUT}"
|
||||
echo "primary_tag=${PRIMARY_TAG}" >> "${GITHUB_OUTPUT}"
|
||||
|
||||
echo "## ISO Uploaded to GHCR" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "Pushed to: \`${GHCR_REPO}:${PRIMARY_TAG}\`" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo '```bash' >> "$GITHUB_STEP_SUMMARY"
|
||||
echo "oras pull ${GHCR_REPO}:${PRIMARY_TAG}" >> "$GITHUB_STEP_SUMMARY"
|
||||
echo '```' >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
- name: Sign ISO OCI Artifact
|
||||
if: inputs.upload_ghcr
|
||||
env:
|
||||
GHCR_REPO: ${{ steps.push-ghcr.outputs.ghcr_repo }}
|
||||
DIGEST: ${{ steps.push-ghcr.outputs.digest }}
|
||||
COSIGN_EXPERIMENTAL: false
|
||||
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
|
||||
run: |
|
||||
# use old bundle format, so we can use newer cosign 3.X.X instead of 2.X.X
|
||||
# https://github.com/containers/container-libs/issues/388
|
||||
# https://github.com/coreos/rpm-ostree/issues/5509
|
||||
cosign sign -y --new-bundle-format=false --use-signing-config=false --key env://COSIGN_PRIVATE_KEY "${GHCR_REPO}@${DIGEST}"
|
||||
|
||||
|
||||
- name: Install rclone
|
||||
if: inputs.upload_r2
|
||||
run: /home/linuxbrew/.linuxbrew/bin/brew install rclone
|
||||
|
|
|
|||
Loading…
Reference in a new issue