[TEST] GHA/build_ci_multi: test debian/fedora/master in PRs #211
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: build_ci_multi_images | |
| 'on': | |
| pull_request: | |
| types: [opened, synchronize, reopened, labeled, unlabeled] | |
| branches: | |
| - main | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| verify_secrets_ghcr: | |
| name: 'Verify credentials (ghcr.io)' | |
| runs-on: 'ubuntu-latest' | |
| steps: | |
| - name: 'versions' | |
| run: podman --version; docker --version | |
| - name: 'login (ghcr.io)' | |
| env: | |
| REGISTRY_USER: '${{ github.repository_owner }}' | |
| REGISTRY_TOKEN: '${{ secrets.GITHUB_TOKEN }}' | |
| run: | | |
| echo "${REGISTRY_TOKEN}" | podman login -u "${REGISTRY_USER}" --password-stdin ghcr.io/"${GITHUB_REPOSITORY_OWNER}" | |
| echo "${REGISTRY_TOKEN}" | docker login -u "${REGISTRY_USER}" --password-stdin ghcr.io/"${GITHUB_REPOSITORY_OWNER}" | |
| - name: 'logout (ghcr.io)' | |
| run: | | |
| podman logout ghcr.io/"${GITHUB_REPOSITORY_OWNER}" | |
| docker logout ghcr.io/"${GITHUB_REPOSITORY_OWNER}" | |
| verify_secrets_docker: | |
| name: 'Verify credentials (docker.io)' | |
| runs-on: 'ubuntu-latest' | |
| if: ${{ github.secret_source == 'Actions' }} | |
| steps: | |
| - name: 'versions' | |
| run: podman --version; docker --version | |
| - name: 'login (docker.io)' | |
| env: | |
| DOCKER_HUB_USER: '${{ secrets.DOCKER_HUB_USER }}' | |
| DOCKER_HUB_TOKEN: '${{ secrets.DOCKER_HUB_TOKEN }}' | |
| run: | | |
| echo "${DOCKER_HUB_TOKEN}" | podman login -u "${DOCKER_HUB_USER}" --password-stdin docker.io | |
| echo "${DOCKER_HUB_TOKEN}" | docker login -u "${DOCKER_HUB_USER}" --password-stdin | |
| - name: 'logout (docker.io)' | |
| run: | | |
| podman logout docker.io | |
| docker logout | |
| verify_secrets_quay: | |
| name: 'Verify credentials (quay.io)' | |
| runs-on: 'ubuntu-latest' | |
| if: ${{ github.secret_source == 'Actions' }} | |
| steps: | |
| - name: 'versions' | |
| run: podman --version; docker --version | |
| - name: 'login (quay.io)' | |
| env: | |
| QUAY_USER: '${{ secrets.QUAY_USER }}' | |
| QUAY_TOKEN: '${{ secrets.QUAY_TOKEN }}' | |
| run: | | |
| echo "${QUAY_TOKEN}" | podman login -u "${QUAY_USER}" --password-stdin quay.io | |
| echo "${QUAY_TOKEN}" | docker login -u "${QUAY_USER}" --password-stdin quay.io | |
| - name: 'logout (quay.io)' | |
| run: | | |
| podman logout quay.io | |
| docker logout quay.io | |
| build_ci: | |
| name: 'build_ci' | |
| runs-on: 'ubuntu-latest' | |
| steps: | |
| - name: 'install dev deps' | |
| run: | | |
| sudo rm -f /etc/apt/sources.list.d/{azure-cli.sources,microsoft-prod.list,ondrej-ubuntu-php-noble.sources} | |
| sudo apt-get -o Dpkg::Use-Pty=0 update | |
| sudo apt-get -o Dpkg::Use-Pty=0 install \ | |
| qemu-user-static buildah less git make podman clamav clamav-freshclam | |
| - name: 'install prereqs' | |
| run: /home/linuxbrew/.linuxbrew/bin/brew install cosign grype trivy | |
| # cosign installed as a test, but not used in this job. | |
| - name: 'versions' | |
| run: | | |
| eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)" | |
| podman --version; docker --version; cosign version | |
| - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: 'build image: master' | |
| run: buildah unshare make branch_or_ref=master release_tag=master build_ref_images | |
| - name: 'test image: master' | |
| run: buildah unshare make dist_name=localhost/curl release_tag=master test | |
| - name: 'security scan image: master' | |
| run: | | |
| eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)" | |
| make image_name=localhost/curl:master scan | |
| - name: 'build image: dev-debian' | |
| run: buildah unshare make branch_or_ref=master release_tag=master build_debian | |
| - name: 'test image: dev-debian' | |
| run: buildah unshare make dist_name=localhost/curl-dev-debian release_tag=master test | |
| - name: 'security scan image: dev-debian' | |
| run: | | |
| eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)" | |
| make image_name=localhost/curl-dev-debian:master scan | |
| - name: 'build image: dev-fedora' | |
| run: buildah unshare make branch_or_ref=master release_tag=master build_fedora | |
| - name: 'test image: dev-fedora' | |
| run: buildah unshare make dist_name=localhost/curl-dev-fedora release_tag=master test | |
| - name: 'security scan image: dev-fedora' | |
| run: | | |
| eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)" | |
| make image_name=localhost/curl-dev-fedora:master scan | |
| build_multi_ci: | |
| name: 'build_multi_ci' | |
| runs-on: 'ubuntu-latest' | |
| steps: | |
| - name: 'install dev deps' | |
| run: | | |
| sudo rm -f /etc/apt/sources.list.d/{azure-cli.sources,microsoft-prod.list,ondrej-ubuntu-php-noble.sources} | |
| sudo apt-get -o Dpkg::Use-Pty=0 update | |
| sudo apt-get -o Dpkg::Use-Pty=0 install \ | |
| qemu-user-static buildah less git make podman clamav clamav-freshclam | |
| - name: 'install prereqs' | |
| run: /home/linuxbrew/.linuxbrew/bin/brew install grype trivy | |
| - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: 'set env vars' | |
| run: | | |
| latest_release_ref=master | |
| echo "TAG_REF=$latest_release_ref" >> "$GITHUB_ENV" | |
| release_image_tag=master | |
| echo "REL=$release_image_tag" >> "$GITHUB_ENV" | |
| - name: 'build image: multi' | |
| run: buildah unshare make branch_or_ref="$TAG_REF" release_tag="$REL" multibuild | |
| - name: 'test image' | |
| run: buildah unshare make dist_name=localhost/curl-multi release_tag="$REL" test | |
| - name: 'security scan image' | |
| run: | | |
| eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)" | |
| make image_name=localhost/curl-multi:"$REL" scan |