add isobuilder
This commit is contained in:
batvin3211
GitHub
parent
c7281fccfc
commit
975ebb2732
1 changed files with 249 additions and 0 deletions
249
action.yml
Normal file
249
action.yml
Normal file
|
|
@ -0,0 +1,249 @@
|
|||
name: BlueOS Build Action
|
||||
description: Builds container images for BlueOS
|
||||
author: JasonN3
|
||||
inputs:
|
||||
image_name:
|
||||
description: name of the image to build
|
||||
required: true
|
||||
image_variant:
|
||||
description: name of the image variant
|
||||
required: false
|
||||
default: ''
|
||||
version:
|
||||
description: primary tag to assign to the image
|
||||
required: true
|
||||
support:
|
||||
description: latest, gts, or empty
|
||||
required: false
|
||||
default: ''
|
||||
extra_build_args:
|
||||
description: extra args to be passed to buildah
|
||||
required: false
|
||||
default: ''
|
||||
signing_key:
|
||||
description: key to sign images
|
||||
required: true
|
||||
#TODO: Split Containerfiles
|
||||
target:
|
||||
description: target to build in Containerfile
|
||||
required: false
|
||||
default: none
|
||||
container_registry:
|
||||
description: registry to store resulting container
|
||||
required: false
|
||||
default: ghcr.io/${{ github.repository_owner }}
|
||||
container_repo:
|
||||
description: repository for the container image
|
||||
required: false
|
||||
default: ${{ github.repository }}
|
||||
container_ref:
|
||||
description: repository ref for the container image
|
||||
required: false
|
||||
default: ${{ github.ref }}
|
||||
push_container:
|
||||
description: whether to push the resulting container image
|
||||
required: false
|
||||
default: "true"
|
||||
|
||||
runs:
|
||||
using: "composite"
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
repository: ${{ inputs.container_repo }}
|
||||
ref: ${{ inputs.container_ref }}
|
||||
submodules: recursive
|
||||
|
||||
- name: Free disk space (Ubuntu)
|
||||
uses: jlumbroso/free-disk-space@v1.3.1
|
||||
with:
|
||||
# this might remove tools that are actually needed,
|
||||
# if set to "true" but frees about 6 GB
|
||||
tool-cache: false
|
||||
|
||||
# all of these default to true, but feel free to set to
|
||||
# "false" if necessary for your workflow
|
||||
android: true
|
||||
dotnet: true
|
||||
haskell: true
|
||||
large-packages: true
|
||||
docker-images: true
|
||||
swap-storage: true
|
||||
|
||||
- name: Generate image name
|
||||
id: generate-name
|
||||
shell: bash
|
||||
run: |
|
||||
if [[ "${{ inputs.image_variant }}" == "main" ]]
|
||||
then
|
||||
echo "image_name=${{ inputs.image_name }}" >> $GITHUB_OUTPUT
|
||||
elif [[ "${{ inputs.image_variant }}" =~ "main-*" ]]
|
||||
then
|
||||
variant=${{ inputs.image_variant }}
|
||||
echo "image_name=${{ inputs.image_name }}-${variant:5}" >> $GITHUB_OUTPUT
|
||||
else
|
||||
echo "image_name=${{ format('{0}-{1}', inputs.image_name, inputs.image_variant) }}" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
|
||||
- name: Generate tags
|
||||
id: generate-tags
|
||||
shell: bash
|
||||
run: |
|
||||
# Run on main
|
||||
if [[ ${{ github.event_name }} != 'pull_request' && ${{ github.ref_name }} == ${{ github.event.repository.default_branch }} ]]
|
||||
then
|
||||
BUILD_TAG="${{ inputs.version }}"
|
||||
COMMIT_TAGS=()
|
||||
COMMIT_TAGS+=("${{ inputs.version }}")
|
||||
if [[ -n "${{ inputs.support }}" ]]
|
||||
then
|
||||
COMMIT_TAGS+=("${{ inputs.support }}")
|
||||
fi
|
||||
# VERSION-YYYYMMDD
|
||||
TIMESTAMP="$(date +%Y%m%d)"
|
||||
COMMIT_TAGS+=("${BUILD_TAG}-${TIMESTAMP}")
|
||||
fi
|
||||
|
||||
# Pull Request
|
||||
if [[ ${{ github.event_name }} == "pull_request" ]]
|
||||
then
|
||||
# pr-#-VERSION
|
||||
BUILD_TAG="pr-${{ github.event.number }}-${{ inputs.version }}"
|
||||
COMMIT_TAGS=()
|
||||
# pr-#-VERSION-SHA
|
||||
SHA_SHORT="${GITHUB_SHA::7}"
|
||||
COMMIT_TAGS+=("$BUILD_TAG-${SHA_SHORT}")
|
||||
# pr-#-VERSION-YYYYMMDD
|
||||
TIMESTAMP="$(date +%Y%m%d)"
|
||||
COMMIT_TAGS+=("${BUILD_TAG}-${TIMESTAMP}")
|
||||
fi
|
||||
|
||||
# Other
|
||||
if [[ -z ${BUILD_TAG} ]]
|
||||
then
|
||||
SHA_SHORT="${GITHUB_SHA::7}"
|
||||
BUILD_TAG="${SHA_SHORT}"
|
||||
fi
|
||||
|
||||
echo "tags=${BUILD_TAG} ${COMMIT_TAGS[*]}" >> $GITHUB_OUTPUT
|
||||
|
||||
# Build metadata
|
||||
- name: Image Metadata
|
||||
uses: docker/metadata-action@v5
|
||||
id: meta
|
||||
with:
|
||||
images: |
|
||||
${{ steps.generate-name.outputs.image_name }}
|
||||
labels: |
|
||||
org.opencontainers.image.title=${{ steps.generate-name.outputs.image_name }}
|
||||
org.opencontainers.image.version=${{ inputs.version }}
|
||||
org.opencontainers.image.description=An interpretation of the Ubuntu spirit built on Fedora technology
|
||||
io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository }}/main/README.md
|
||||
io.artifacthub.package.logo-url=https://avatars.githubusercontent.com/u/120078124?s=200&v=4
|
||||
|
||||
- name: Determine extra args
|
||||
id: extra-args
|
||||
shell: bash
|
||||
run: |
|
||||
if [[ ${{ inputs.target }} == "none" ]]
|
||||
then
|
||||
echo "args=" >> $GITHUB_OUTPUT
|
||||
else
|
||||
echo "args=--target=${{ inputs.target }}" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
|
||||
# Build image using Buildah action
|
||||
- name: Build Image
|
||||
id: build_image
|
||||
uses: redhat-actions/buildah-build@v2
|
||||
with:
|
||||
containerfiles: |
|
||||
./Containerfile
|
||||
image: ${{ steps.generate-name.outputs.image_name }}
|
||||
tags: ${{ steps.generate-tags.outputs.tags }}
|
||||
build-args: |
|
||||
IMAGE_NAME=${{ inputs.image_name }}
|
||||
IMAGE_FLAVOR=${{ inputs.image_variant }}
|
||||
IMAGE_VENDOR=${{ github.repository_owner }}
|
||||
FEDORA_MAJOR_VERSION=${{ inputs.version }}
|
||||
TARGET_BASE=${{ inputs.image_variant }}
|
||||
${{ inputs.extra_build_args }}
|
||||
labels: ${{ steps.meta.outputs.labels }}
|
||||
oci: false
|
||||
#TODO: Split Containerfiles
|
||||
extra-args: ${{ steps.extra-args.outputs.args }}
|
||||
|
||||
|
||||
- name: Get list of images to verify
|
||||
id: images_to_verify
|
||||
shell: bash
|
||||
run: |
|
||||
# grep may return 1 if no ublue images were used
|
||||
set +o pipefail
|
||||
ublue_images=$(buildah images | tail -n +2 | grep -v localhost | awk '{print $1}' | grep '^ghcr.io/ublue-os' | tr '\n' ' ')
|
||||
chainguard_images=$(buildah images | tail -n +2 | grep -v localhost | awk '{print $1}' | grep '^cgr.dev/chainguard' | tr '\n' ' ')
|
||||
|
||||
echo "ublue_images=${ublue_images}" >> $GITHUB_OUTPUT
|
||||
echo "chainguard_images=${chainguard_images}" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Verify base image
|
||||
if: ${{ steps.images_to_verify.output.ublue_images }} != ''
|
||||
uses: EyeCantCU/cosign-action/verify@v0.2.2
|
||||
with:
|
||||
containers: ${{ steps.images_to_verify.output.ublue_images }}
|
||||
pubkey: https://raw.githubusercontent.com/ublue-os/main/main/cosign.pub
|
||||
|
||||
- name: Verify chainguard images
|
||||
if: ${{ steps.images_to_verify.output.chainguard_images }} != ''
|
||||
uses: EyeCantCU/cosign-action/verify@v0.2.2
|
||||
with:
|
||||
containers: ${{ steps.images_to_verify.output.chainguard_images }}
|
||||
cert-identity: https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main
|
||||
oidc-issuer: https://token.actions.githubusercontent.com
|
||||
registry: cgr.dev/chainguard
|
||||
|
||||
# Workaround bug where capital letters in your GitHub username make it impossible to push to GHCR.
|
||||
# https://github.com/macbre/push-to-ghcr/issues/12
|
||||
- name: Lowercase Registry
|
||||
id: registry_case
|
||||
uses: ASzc/change-string-case-action@v6
|
||||
with:
|
||||
string: ${{ inputs.container_registry }}
|
||||
|
||||
# Push the image to GHCR (Image Registry)
|
||||
- name: Push To GHCR
|
||||
id: push
|
||||
if: inputs.push_container == 'true'
|
||||
env:
|
||||
REGISTRY_USER: ${{ github.actor }}
|
||||
REGISTRY_PASSWORD: ${{ github.token }}
|
||||
uses: redhat-actions/push-to-registry@v2
|
||||
with:
|
||||
image: ${{ steps.build_image.outputs.image }}
|
||||
tags: ${{ steps.generate-tags.outputs.tags }}
|
||||
registry: ${{ steps.registry_case.outputs.lowercase }}
|
||||
username: ${{ env.REGISTRY_USER }}
|
||||
password: ${{ env.REGISTRY_PASSWORD }}
|
||||
|
||||
- name: Login to GitHub Container Registry
|
||||
uses: docker/login-action@v3
|
||||
if: inputs.push_container == 'true' && github.event_name == 'push' && github.ref == github.event.repository.default_branch
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ github.actor }}
|
||||
password: ${{ github.token }}
|
||||
|
||||
# Sign container
|
||||
- uses: sigstore/cosign-installer@v3.4.0
|
||||
if: inputs.push_container == 'true' && github.event_name == 'push' && github.ref == github.event.repository.default_branch
|
||||
|
||||
- name: Sign container image
|
||||
shell: bash
|
||||
if: inputs.push_container == 'true' && github.event_name == 'push' && github.ref == github.event.repository.default_branch
|
||||
run: |
|
||||
cosign sign -y --key env://COSIGN_PRIVATE_KEY ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS}
|
||||
env:
|
||||
TAGS: ${{ steps.push.outputs.digest }}
|
||||
COSIGN_EXPERIMENTAL: "false"
|
||||
COSIGN_PRIVATE_KEY: ${{ inputs.signing_key }}
|
||||
Loading…
Add table
Add a link
Reference in a new issue