Build container image #16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | ||
| name: Build container image | ||
| on: | ||
| pull_request: | ||
| # branches: | ||
| # - main | ||
| #schedule: | ||
| # - cron: '05 10 * * *' # 10:05am UTC everyday | ||
| #push: | ||
| # branches: | ||
| # - main | ||
| # paths-ignore: | ||
| # - '**/README.md' | ||
| workflow_dispatch: | ||
| env: | ||
| IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}" # do not edit | ||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }} | ||
| cancel-in-progress: true | ||
| jobs: | ||
| build_push: | ||
| name: Build and push image | ||
| runs-on: ubuntu-24.04 | ||
| permissions: | ||
| contents: read | ||
| packages: write | ||
| id-token: write | ||
| steps: | ||
| # These stage versions are pinned by https://github.com/renovatebot/renovate | ||
| - name: Checkout | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | ||
| - name: Maximize build space | ||
| uses: ublue-os/remove-unwanted-software@695eb75bc387dbcd9685a8e72d23439d8686cba6 | ||
| - name: Install just | ||
| uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 #v4.0.0 | ||
| - name: Check Just Syntax | ||
| shell: bash | ||
| run: | | ||
| just check | ||
| - name: Image Name | ||
| id: image-name | ||
| run: | | ||
| IMAGE_NAME=$(just image_name) | ||
| echo "IMAGE_NAME=${IMAGE_NAME}" >> $GITHUB_ENV | ||
| - name: Default Tag | ||
| id: gen-default-tag | ||
| run: | | ||
| DEFAULT_TAG=$(just generate-default-tag) | ||
| echo "DEFAULT_TAG=${DEFAULT_TAG}" >> $GITHUB_ENV | ||
| - name: Prepare environment | ||
| run: | | ||
| # Lowercase the image uri https://github.com/macbre/push-to-ghcr/issues/12 | ||
| echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV} | ||
| echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV} | ||
| # This actually builds the container image | ||
| - name: Build Image | ||
| id: build-image | ||
| run: | | ||
| sudo -E $(command -v just) build \ | ||
| ${IMAGE_NAME} \ | ||
| ${DEFAULT_TAG} | ||
| # This is optional, this provides smaller delta updates | ||
| - name: Rechunk with rpm-ostree | ||
| id: rechunk | ||
| run: | | ||
| sudo -E $(command -v just) ostree-rechunk \ | ||
| ${IMAGE_NAME} \ | ||
| ${DEFAULT_TAG} | ||
| # If you are feeling adventurous, use the new distro agnostic rechunker | ||
| # https://github.com/coreos/chunkah | ||
| # You can delete the Rechunk with rpm-ostree portion then if you use this | ||
| #- name: Rechunk with Chunkah | ||
| # id: rechunk | ||
| # run: | | ||
| # sudo -E $(command -v just) rechunk \ | ||
| # ${IMAGE_NAME} \ | ||
| # ${DEFAULT_TAG} | ||
| - name: Generate Build Tags | ||
| id: gen-build-tags | ||
| run: | | ||
| alias_tags="$(just generate-build-tags \ | ||
| ${IMAGE_NAME} \ | ||
| ${DEFAULT_TAG})" | ||
| echo "Tags for this Action..." | ||
| echo "${alias_tags}" | ||
| echo "alias_tags=${alias_tags}" >> $GITHUB_OUTPUT | ||
| - name: Tag Image | ||
| id: tag-images | ||
| env: | ||
| ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }} | ||
| run: | | ||
| sudo -E $(command -v just) tag-images \ | ||
| "${IMAGE_NAME}" \ | ||
| "${DEFAULT_TAG}" \ | ||
| "${ALIAS_TAGS}" | ||
| # These `if` statements are so that pull requests for your custom images do not make it publish any packages under your name without you knowing | ||
| # They also check if the runner is on the default branch so that things like the merge queue (if you enable it), are going to work | ||
| - name: Login to GitHub Container Registry | ||
| uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c # v4.5.0 | ||
| if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) | ||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
| - name: Push To GHCR | ||
| if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) | ||
| id: push-image | ||
| env: | ||
| ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }} | ||
| run: | | ||
| set -euox pipefail | ||
| for tag in ${ALIAS_TAGS}; do | ||
| sudo -E podman push --digestfile=/tmp/digestfile ${IMAGE_NAME}:${tag} ${IMAGE_REGISTRY}/${IMAGE_NAME}:${tag} | ||
| done | ||
| digest=$(< /tmp/digestfile) | ||
| echo "digest=${digest}" >> $GITHUB_OUTPUT | ||
| # This section is optional and only needs to be enabled if you plan on distributing | ||
| # your project for others to consume. You will need to create a public and private key | ||
| # using Cosign and save the private key as a repository secret in Github for this workflow | ||
| # to consume. For more details, review the image signing section of the README. | ||
| - name: Install Cosign | ||
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | ||
| if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) | ||
| # https://github.com/containers/container-libs/issues/388 | ||
| with: | ||
| cosign-release: 'v2.6.3' | ||
| - name: Sign container image | ||
| id: sign-image | ||
| if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) | ||
| env: | ||
| COSIGN_EXPERIMENTAL: false | ||
| COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} | ||
| DIGEST: ${{ steps.push-image.outputs.digest }} | ||
| run: | | ||
| cosign sign -y --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST} | ||
| build_disk: | ||
|
Check failure on line 162 in .github/workflows/build.yml
|
||
| name: Build disk images | ||
| permissions: | ||
| id-token: write | ||
| needs: [build_push] | ||
| uses: ./.github/workflows/build-disk.yml | ||
| with: | ||
| platform: amd64 | ||
| upload-to-s3: false | ||
| secrets: inherit | ||
