diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 015b398..3a979f3 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,254 +1,4 @@ --- -name: BlueOS Build Action -description: Builds container images for BlueOS -author: JasonN3 -inputs: - image_name: - description: name of the image to build - required: true - image_variant: - description: name of the image variant - required: false - default: '' - version: - description: primary tag to assign to the image - required: true - support: - description: latest, gts, or empty - required: false - default: '' - extra_build_args: - description: extra args to be passed to buildah - required: false - default: '' - signing_key: - description: key to sign images - required: true - #TODO: Split Containerfiles - target: - description: target to build in Containerfile - required: false - default: none - container_registry: - description: registry to store resulting container - required: false - default: ghcr.io/${{ github.repository_owner }} - container_repo: - description: repository for the container image - required: false - default: ${{ github.repository }} - container_ref: - description: repository ref for the container image - required: false - default: ${{ github.ref }} - push_container: - description: whether to push the resulting container image - required: false - default: "true" - -runs: - using: "composite" - steps: - - name: Checkout - uses: actions/checkout@v4 - with: - repository: ${{ inputs.container_repo }} - ref: ${{ inputs.container_ref }} - submodules: recursive - - - name: Free disk space (Ubuntu) - uses: jlumbroso/free-disk-space@v1.3.1 - with: - # this might remove tools that are actually needed, - # if set to "true" but frees about 6 GB - tool-cache: false - - # all of these default to true, but feel free to set to - # "false" if necessary for your workflow - android: true - dotnet: true - haskell: true - large-packages: true - docker-images: true - swap-storage: true - - - name: Generate image name - id: generate-name - shell: bash - run: | - if [[ "${{ inputs.image_variant }}" == "main" ]] - then - echo "image_name=${{ inputs.image_name }}" >> $GITHUB_OUTPUT - elif [[ "${{ inputs.image_variant }}" =~ "main-*" ]] - then - variant=${{ inputs.image_variant }} - echo "image_name=${{ inputs.image_name }}-${variant:5}" >> $GITHUB_OUTPUT - else - echo "image_name=${{ format('{0}-{1}', inputs.image_name, inputs.image_variant) }}" >> $GITHUB_OUTPUT - fi - - - name: Generate tags - id: generate-tags - shell: bash - run: | - # Run on main - if [[ ${{ github.event_name }} != 'pull_request' && ${{ github.ref_name }} == ${{ github.event.repository.default_branch }} ]] - then - BUILD_TAG="${{ inputs.version }}" - COMMIT_TAGS=() - COMMIT_TAGS+=("${{ inputs.version }}") - if [[ -n "${{ inputs.support }}" ]] - then - COMMIT_TAGS+=("${{ inputs.support }}") - fi - # VERSION-YYYYMMDD - TIMESTAMP="$(date +%Y%m%d)" - COMMIT_TAGS+=("${BUILD_TAG}-${TIMESTAMP}") - fi - - # Pull Request - if [[ ${{ github.event_name }} == "pull_request" ]] - then - # pr-#-VERSION - BUILD_TAG="pr-${{ github.event.number }}-${{ inputs.version }}" - COMMIT_TAGS=() - # pr-#-VERSION-SHA - SHA_SHORT="${GITHUB_SHA::7}" - COMMIT_TAGS+=("$BUILD_TAG-${SHA_SHORT}") - # pr-#-VERSION-YYYYMMDD - TIMESTAMP="$(date +%Y%m%d)" - COMMIT_TAGS+=("${BUILD_TAG}-${TIMESTAMP}") - fi - - # Other - if [[ -z ${BUILD_TAG} ]] - then - SHA_SHORT="${GITHUB_SHA::7}" - BUILD_TAG="${SHA_SHORT}" - fi - - echo "tags=${BUILD_TAG} ${COMMIT_TAGS[*]}" >> $GITHUB_OUTPUT - - # Build metadata - - name: Image Metadata - uses: docker/metadata-action@v5 - id: meta - with: - images: | - ${{ steps.generate-name.outputs.image_name }} - labels: | - org.opencontainers.image.title=${{ steps.generate-name.outputs.image_name }} - org.opencontainers.image.version=${{ inputs.version }} - org.opencontainers.image.description=An interpretation of the Ubuntu spirit built on Fedora technology - io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository }}/main/README.md - io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/120078124?s=200&v=4 - - - name: Determine extra args - id: extra-args - shell: bash - run: | - if [[ ${{ inputs.target }} == "none" ]] - then - echo "args=" >> $GITHUB_OUTPUT - else - echo "args=--target=${{ inputs.target }}" >> $GITHUB_OUTPUT - fi - - # Build image using Buildah action - - name: Build Image - id: build_image - uses: redhat-actions/buildah-build@v2 - with: - containerfiles: | - ./Containerfile - image: ${{ steps.generate-name.outputs.image_name }} - tags: ${{ steps.generate-tags.outputs.tags }} - build-args: | - IMAGE_NAME=${{ inputs.image_name }} - IMAGE_FLAVOR=${{ inputs.image_variant }} - IMAGE_VENDOR=${{ github.repository_owner }} - FEDORA_MAJOR_VERSION=${{ inputs.version }} - TARGET_BASE=${{ inputs.image_variant }} - ${{ inputs.extra_build_args }} - labels: ${{ steps.meta.outputs.labels }} - oci: false - #TODO: Split Containerfiles - extra-args: ${{ steps.extra-args.outputs.args }} - - - - name: Get list of images to verify - id: images_to_verify - shell: bash - run: | - # grep may return 1 if no ublue images were used - set +o pipefail - ublue_images=$(buildah images | tail -n +2 | grep -v localhost | awk '{print $1}' | grep '^ghcr.io/ublue-os' | tr '\n' ' ') - chainguard_images=$(buildah images | tail -n +2 | grep -v localhost | awk '{print $1}' | grep '^cgr.dev/chainguard' | tr '\n' ' ') - - echo "ublue_images=${ublue_images}" >> $GITHUB_OUTPUT - echo "chainguard_images=${chainguard_images}" >> $GITHUB_OUTPUT - - - name: Verify base image - if: ${{ steps.images_to_verify.output.ublue_images }} != '' - uses: EyeCantCU/cosign-action/verify@v0.2.2 - with: - containers: ${{ steps.images_to_verify.output.ublue_images }} - pubkey: https://raw.githubusercontent.com/ublue-os/main/main/cosign.pub - - - name: Verify chainguard images - if: ${{ steps.images_to_verify.output.chainguard_images }} != '' - uses: EyeCantCU/cosign-action/verify@v0.2.2 - with: - containers: ${{ steps.images_to_verify.output.chainguard_images }} - cert-identity: https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main - oidc-issuer: https://token.actions.githubusercontent.com - registry: cgr.dev/chainguard - - # Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR. - # https://github.com/macbre/push-to-ghcr/issues/12 - - name: Lowercase Registry - id: registry_case - uses: ASzc/change-string-case-action@v6 - with: - string: ${{ inputs.container_registry }} - - # Push the image to GHCR (Image Registry) - - name: Push To GHCR - id: push - if: inputs.push_container == 'true' - env: - REGISTRY_USER: ${{ github.actor }} - REGISTRY_PASSWORD: ${{ github.token }} - uses: redhat-actions/push-to-registry@v2 - with: - image: ${{ steps.build_image.outputs.image }} - tags: ${{ steps.generate-tags.outputs.tags }} - registry: ${{ steps.registry_case.outputs.lowercase }} - username: ${{ env.REGISTRY_USER }} - password: ${{ env.REGISTRY_PASSWORD }} - - - name: Login to GitHub Container Registry - uses: docker/login-action@v3 - if: inputs.push_container == 'true' && github.event_name == 'push' && github.ref == github.event.repository.default_branch - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ github.token }} - - # Sign container - - uses: sigstore/cosign-installer@v3.4.0 - if: inputs.push_container == 'true' && github.event_name == 'push' && github.ref == github.event.repository.default_branch - - - name: Sign container image - shell: bash - if: inputs.push_container == 'true' && github.event_name == 'push' && github.ref == github.event.repository.default_branch - run: | - cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS} - env: - TAGS: ${{ steps.push.outputs.digest }} - COSIGN_EXPERIMENTAL: "false" - COSIGN_PRIVATE_KEY: ${{ inputs.signing_key }} - name: build-ublue-custom on: pull_request: @@ -401,6 +151,3 @@ jobs: TAGS: ${{ steps.push.outputs.digest }} COSIGN_EXPERIMENTAL: false COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} - - -