Skip to content

Commit 0fe50b9

Browse files
fmoessbauerfmoessbauer
committed
feat: build and release container image in CI
Signed-off-by: Felix Moessbauer <[email protected]>
1 parent da7a557 commit 0fe50b9

File tree

3 files changed

+198
-0
lines changed

3 files changed

+198
-0
lines changed

‎.github/actions/docker-init/action.yml‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
# Copyright (C) 2025 Siemens
2+
#
3+
# SPDX-License-Identifier: MIT
4+
#
5+
# Derived from the https://github.com/siemens/kas docker-init action
6+
7+
name: docker-init
8+
9+
inputs:
10+
deploy-user:
11+
required: true
12+
deploy-token:
13+
required: true
14+
15+
runs:
16+
using: composite
17+
steps:
18+
- name: Set up QEMU
19+
shell: bash
20+
env:
21+
QEMU_USER_STATIC_PACKAGE: qemu-user-static_7.2+dfsg-7+deb12u12_amd64.deb
22+
REPO_DATE: 20250130T084806Z
23+
PACKAGE_SHA256: 1a2696081c1f30d464f79fd300196822397c77f05440ea9ce6dc8e9658b595ec
24+
run: |
25+
# temporarily use Debian qemu-user-static until Ubuntu fixes theirs
26+
wget -q http://snapshot.debian.org/archive/debian/${REPO_DATE}/pool/main/q/qemu/${QEMU_USER_STATIC_PACKAGE}
27+
echo "${PACKAGE_SHA256} ${QEMU_USER_STATIC_PACKAGE}" | sha256sum -c
28+
sudo dpkg -i ${QEMU_USER_STATIC_PACKAGE}
29+
30+
- name: Set up Docker Buildx
31+
uses: docker/setup-buildx-action@v3
32+
with:
33+
driver-opts: image=moby/buildkit:v0.16.0
34+
35+
- name: Login to ghcr.io
36+
uses: docker/login-action@v3
37+
with:
38+
registry: ghcr.io
39+
username: ${{ inputs.deploy-user }}
40+
password: ${{ inputs.deploy-token }}
41+
42+
- name: Set SOURCE_DATE_EPOCH
43+
run: |
44+
echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
45+
shell: bash
46+
47+
- name: Determine Debian tag
48+
run: |
49+
COMMIT_DATE=$(date -d @$(git log -1 --pretty=%ct) +%Y%m%d)
50+
DEBIAN_RELEASE=$(grep -m 1 'ARG DEBIAN_TAG=' Dockerfile | sed 's/.*DEBIAN_TAG=\(.*\)-.*/\1/')
51+
echo "DEBIAN_TAG=$(podman search --list-tags docker.io/debian --limit 1000000000 | \
52+
grep "$DEBIAN_RELEASE-.*-slim" | sort -r | sed 's/.*[ ]\+//' | \
53+
./scripts/lower-bound.py $DEBIAN_RELEASE-$COMMIT_DATE-slim )" \
54+
>> $GITHUB_ENV
55+
shell: bash
56+
57+
- name: Prepare repository for COPY-in
58+
run: |
59+
git clone . /home/runner/debsbom-clone
60+
shell: bash
61+
62+
- name: Define image metadata
63+
run: |
64+
echo "IMAGE_DESCRIPTION=debsbom generates (Software Bill of Materials) for distributions based on Debian" >> $GITHUB_ENV
65+
# make image metadata reproducible (also for image re-builders)
66+
echo "IMAGE_COMMIT_DATE=$(date -d @$(git log -1 --pretty=%ct) --iso-8601=seconds)" >> $GITHUB_ENV
67+
echo "IMAGE_OFFICIAL_URL=https://github.com/siemens/debsbom" >> $GITHUB_ENV
68+
shell: bash
69+
70+
- name: Extract metadata
71+
id: meta
72+
uses: docker/metadata-action@v5
73+
with:
74+
annotations: |
75+
org.opencontainers.image.description=${{ env.IMAGE_DESCRIPTION }}
76+
org.opencontainers.image.licenses=MIT
77+
org.opencontainers.image.created=${{ env.IMAGE_COMMIT_DATE }}
78+
org.opencontainers.image.source=${{ env.IMAGE_OFFICIAL_URL }}
79+
org.opencontainers.image.url=${{ env.IMAGE_OFFICIAL_URL }}
80+
env:
81+
DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
82+
83+
- name: Cache apt
84+
id: cache-apt
85+
uses: actions/cache@v4
86+
with:
87+
path: |
88+
var-cache-apt
89+
var-lib-apt
90+
key: cache-apt-${{ env.DEBIAN_TAG }}-${{ inputs.image-name }}
91+
92+
- name: Inject cache into docker
93+
uses: reproducible-containers/buildkit-cache-dance@5b6db76d1da5c8b307d5d2e0706d266521b710de #v3.1.2
94+
with:
95+
cache-map: |
96+
{
97+
"var-cache-apt": "/var/cache/apt",
98+
"var-lib-apt": "/var/lib/apt"
99+
}
100+
skip-extraction: ${{ steps.cache.outputs.cache-hit }}

‎.github/workflows/containers.yml‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# Copyright (C) 2025 Siemens
2+
#
3+
# SPDX-License-Identifier: MIT
4+
name: Containers
5+
6+
on:
7+
push:
8+
9+
jobs:
10+
build_containers:
11+
name: Build, test and deploy container images
12+
runs-on: ubuntu-24.04
13+
permissions:
14+
id-token: write
15+
packages: write
16+
contents: read
17+
attestations: write
18+
steps:
19+
- name: Check out repo
20+
uses: actions/checkout@v4
21+
- name: Set up docker build
22+
uses: ./.github/actions/docker-init
23+
with:
24+
deploy-user: ${{ github.actor }}
25+
deploy-token: ${{ secrets.GITHUB_TOKEN }}
26+
27+
- name: Build debsbom image
28+
uses: docker/build-push-action@v6
29+
with:
30+
context: /home/runner/debsbom-clone
31+
target: debsbom
32+
platforms: linux/amd64
33+
build-args: |
34+
SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
35+
DEBIAN_TAG=${{ env.DEBIAN_TAG }}
36+
outputs: type=docker,rewrite-timestamp=true
37+
tags: ghcr.io/${{ github.repository }}/debsbom:test
38+
- name: Test debsbom image
39+
run: |
40+
docker run ghcr.io/${{ github.repository }}/debsbom:test debsbom --version
41+
mkdir downloads
42+
echo "guestfs-tools 1.52.3-1 source" | \
43+
docker run -v$(pwd)/downloads:/mnt/downloads -i ghcr.io/${{ github.repository }}/debsbom:test \
44+
debsbom download --outdir /mnt/downloads --sources
45+
find downloads/sources -name "guestfs-tools*" | grep .
46+
- name: Complete build and deploy image
47+
if: github.ref == 'refs/heads/main'
48+
uses: docker/build-push-action@v6
49+
id: push
50+
with:
51+
context: /home/runner/debsbom-clone
52+
target: debsbom
53+
platforms: linux/amd64,linux/arm64
54+
build-args: |
55+
SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
56+
DEBIAN_TAG=${{ env.DEBIAN_TAG }}
57+
provenance: false
58+
outputs: type=registry,rewrite-timestamp=true
59+
tags: ghcr.io/${{ github.repository }}/debsbom:latest
60+
annotations: ${{ env.DOCKER_METADATA_OUTPUT_ANNOTATIONS }}
61+
- name: Attest image
62+
if: github.ref == 'refs/heads/main'
63+
uses: actions/attest-build-provenance@v1
64+
with:
65+
subject-name: ghcr.io/${{ github.repository }}/debsbom
66+
subject-digest: ${{ steps.push.outputs.digest }}
67+
push-to-registry: true
68+
69+
cleanup_ghcr_containers:
70+
name: cleanup untagged containers
71+
if: github.ref == 'refs/heads/main'
72+
runs-on: ubuntu-24.04
73+
needs: build_containers
74+
permissions:
75+
packages: write
76+
steps:
77+
- uses: dataaxiom/ghcr-cleanup-action@cd0cdb900b5dbf3a6f2cc869f0dbb0b8211f50c4 #v1.0.16
78+
with:
79+
dry-run: false
80+
validate: true
81+
package: debsbom
82+
token: ${{ secrets.GITHUB_TOKEN }}

‎scripts/lower-bound.py‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/usr/bin/env python3
2+
#
3+
# Copyright (C) 2025 Siemens
4+
#
5+
# SPDX-License-Identifier: MIT
6+
#
7+
# Takes a reverse-sorted, line separated list and
8+
# returns the first element that is equal or smaller
9+
# than the first argument.
10+
11+
import sys
12+
13+
for line in sys.stdin:
14+
if line.rstrip() <= sys.argv[1]:
15+
print(line.rstrip())
16+
break

0 commit comments

Comments
 (0)