Create Release Docker Images #114
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Create Release Docker Images | |
| on: | |
| push: | |
| tags: | |
| - v* | |
| workflow_dispatch: | |
| inputs: | |
| release_version: | |
| description: 'Comma-separated list of versions to build, e.g. v3.4,v3.5' | |
| default: 'v3.4,v3.5' | |
| required: true | |
| type: string | |
| update_latest: | |
| description: 'Update "X.Y-latest" images.' | |
| default: false | |
| required: true | |
| type: boolean | |
| schedule: | |
| - cron: "35 00 * * 0" | |
| env: | |
| DOCKERHUB_BASE_REPO: dtcenter/met-base | |
| DOCKERHUB_UNIT_TEST_REPO: dtcenter/met-base-unit-test | |
| DOCKERHUB_METVIEWER_REPO: dtcenter/met-base-metviewer | |
| DEBIAN_REGISTRY: registry1.dso.mil | |
| DEBIAN_IMAGE: ironbank/opensource/debian/debian | |
| jobs: | |
| define-matrix: | |
| name: Define Matrix | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.get-versions.outputs.matrix }} | |
| update_latest: ${{ steps.get-versions.outputs.update_latest }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| repository: 'dtcenter/metplus' | |
| ref: 'develop' | |
| sparse-checkout: metplus/component_versions.py | |
| sparse-checkout-cone-mode: false | |
| - name: Get versions to build | |
| id: get-versions | |
| run: | | |
| if [[ ${{ github.event_name }} == 'schedule' ]]; then | |
| version_string="v3.4,v3.5" | |
| update_latest="true" | |
| elif [[ ${{ github.event_name }} == 'workflow_dispatch' ]]; then | |
| version_string=${{ toJSON(inputs.release_version) }} | |
| update_latest=${{ toJSON(inputs.update_latest) }} | |
| else | |
| version_string=${{ toJSON(github.ref_name) }} | |
| update_latest="true" | |
| fi | |
| IFS=',' read -r -a version_array <<< "${version_string}" | |
| matrix="{\"version\": [" | |
| for version in "${version_array[@]}"; do | |
| if [[ ${version} =~ ^v[0-9]+.[0-9]+$ ]]; then | |
| matrix+=\"$(${GITHUB_WORKSPACE}/metplus/component_versions.py -v ${version} -i METbaseimage -o METbaseimage)\", | |
| else | |
| matrix+=\"${version}\", | |
| fi | |
| done | |
| matrix+="],\"component\": [\"met\", \"metviewer\"]}" | |
| echo "matrix=${matrix}" >> $GITHUB_OUTPUT | |
| echo "update_latest=${update_latest}" >> $GITHUB_OUTPUT | |
| build_scan_and_push: | |
| name: Build, Scan, and Push Images | |
| runs-on: ubuntu-latest | |
| needs: define-matrix | |
| strategy: | |
| fail-fast: false | |
| matrix: ${{ fromJSON(needs.define-matrix.outputs.matrix) }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Free Disk Space | |
| uses: dtcenter/metplus-action-free-disk-space@v1 | |
| - uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ matrix.version }} | |
| path: ${{ matrix.version }} | |
| - name: Get DockerHub tags | |
| id: get-dockerhub-tags | |
| run: | | |
| source ${GITHUB_WORKSPACE}/.github/jobs/bash_functions.sh | |
| base_repo_tag=$(get_dockerhub_tag ${{ env.DOCKERHUB_BASE_REPO }} ${{ matrix.version }}) | |
| unit_test_repo_tag=$(get_dockerhub_tag ${{ env.DOCKERHUB_UNIT_TEST_REPO }} ${{ matrix.version }}) | |
| metviewer_repo_tag=$(get_dockerhub_tag ${{ env.DOCKERHUB_METVIEWER_REPO }} ${{ matrix.version }}) | |
| echo "base_repo_tag=${base_repo_tag}" >> $GITHUB_OUTPUT | |
| echo "unit_test_repo_tag=${unit_test_repo_tag}" >> $GITHUB_OUTPUT | |
| echo "metviewer_repo_tag=${metviewer_repo_tag}" >> $GITHUB_OUTPUT | |
| env: | |
| SOURCE_BRANCH: ${{ matrix.version }} | |
| - name: Create directories to store build log output | |
| run: mkdir -p ${RUNNER_WORKSPACE}/logs | |
| - name: Authenticate IronBank | |
| run: echo "${{ secrets.IRONBANK_SECRET }}" | docker login -u ${{ secrets.IRONBANK_USERNAME }} --password-stdin registry1.dso.mil | |
| - name: Build Docker Image | |
| run: .github/jobs/build_docker_image.sh | |
| env: | |
| GITHUB_NAME: ${{ matrix.version }} | |
| METPLUS_COMPONENT: ${{ matrix.component }} | |
| - name: Copy build log files into logs directory | |
| if: always() | |
| run: cp ${GITHUB_WORKSPACE}/*.log ${RUNNER_WORKSPACE}/logs/ | |
| - name: Upload build logs as artifact | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: build_logs_${{ matrix.component }}_${{ matrix.version }} | |
| path: ${{ runner.workspace }}/logs | |
| if-no-files-found: ignore | |
| # scan base_repo_tag and unit_test_repo_tag if component is met | |
| # scan metviewer_repo_tag if component is metviewer | |
| - name: Scan Docker Images | |
| uses: dtcenter/metplus-action-scan-docker-images@v2 | |
| with: | |
| images: | | |
| [ | |
| ${{ matrix.component == 'met' && format('"{0}", "{1}"', steps.get-dockerhub-tags.outputs.base_repo_tag, steps.get-dockerhub-tags.outputs.unit_test_repo_tag) || format('"{0}"', steps.get-dockerhub-tags.outputs.metviewer_repo_tag) }} | |
| ] | |
| fail-on-critical: "false" | |
| log-artifact-name: "security-scan-logs_${{ matrix.component }}_${{ matrix.version }}" | |
| - name: Push Docker Image | |
| run: .github/jobs/push_docker_image.sh | |
| env: | |
| GITHUB_NAME: ${{ matrix.version }} | |
| METPLUS_COMPONENT: ${{ matrix.component }} | |
| UPDATE_LATEST: ${{ fromJSON(needs.define-matrix.outputs.update_latest) }} | |
| DOCKER_USERNAME: 'dtcenter' | |
| DOCKER_PASSWORD: ${{ secrets.DOCKER_TOKEN }} |