Skip to content

Commit bbae9a6

Browse files
fmoessbauerfmoessbauer
committed
feat: build and release container image in CI
Signed-off-by: Felix Moessbauer <[email protected]>
1 parent 48a7762 commit bbae9a6

File tree

3 files changed

+196
-0
lines changed

3 files changed

+196
-0
lines changed

‎.github/actions/docker-init/action.yml‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
# Copyright (C) 2025 Siemens
2+
#
3+
# SPDX-License-Identifier: MIT
4+
#
5+
# Derived from the https://github.com/siemens/kas docker-init action
6+
7+
name: docker-init
8+
9+
inputs:
10+
deploy-user:
11+
required: true
12+
deploy-token:
13+
required: true
14+
15+
runs:
16+
using: composite
17+
steps:
18+
- name: Set up QEMU
19+
shell: bash
20+
env:
21+
QEMU_USER_STATIC_PACKAGE: qemu-user-static_7.2+dfsg-7+deb12u12_amd64.deb
22+
REPO_DATE: 20250130T084806Z
23+
PACKAGE_SHA256: 1a2696081c1f30d464f79fd300196822397c77f05440ea9ce6dc8e9658b595ec
24+
run: |
25+
# temporarily use Debian qemu-user-static until Ubuntu fixes theirs
26+
wget -q http://snapshot.debian.org/archive/debian/${REPO_DATE}/pool/main/q/qemu/${QEMU_USER_STATIC_PACKAGE}
27+
echo "${PACKAGE_SHA256} ${QEMU_USER_STATIC_PACKAGE}" | sha256sum -c
28+
sudo dpkg -i ${QEMU_USER_STATIC_PACKAGE}
29+
30+
- name: Set up Docker Buildx
31+
uses: docker/setup-buildx-action@v3
32+
with:
33+
driver-opts: image=moby/buildkit:v0.16.0
34+
35+
- name: Login to ghcr.io
36+
uses: docker/login-action@v3
37+
with:
38+
registry: ghcr.io
39+
username: ${{ inputs.deploy-user }}
40+
password: ${{ inputs.deploy-token }}
41+
42+
- name: Set SOURCE_DATE_EPOCH
43+
run: |
44+
echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
45+
shell: bash
46+
47+
- name: Determine Debian tag
48+
run: |
49+
COMMIT_DATE=$(date -d @$(git log -1 --pretty=%ct) +%Y%m%d)
50+
DEBIAN_RELEASE=$(grep -m 1 'ARG DEBIAN_TAG=' Dockerfile | sed 's/.*DEBIAN_TAG=\(.*\)-.*/\1/')
51+
echo "DEBIAN_TAG=$(podman search --list-tags docker.io/debian --limit 1000000000 | \
52+
grep "$DEBIAN_RELEASE-.*-slim" | sort -r | sed 's/.*[ ]\+//' | \
53+
./scripts/lower-bound.py $DEBIAN_RELEASE-$COMMIT_DATE-slim )" \
54+
>> $GITHUB_ENV
55+
shell: bash
56+
57+
- name: Prepare repository for COPY-in
58+
run: |
59+
git clone . /home/runner/debsbom-clone
60+
shell: bash
61+
62+
- name: Define image metadata
63+
run: |
64+
echo "IMAGE_DESCRIPTION=debsbom generates (Software Bill of Materials) for distributions based on Debian" >> $GITHUB_ENV
65+
# make image metadata reproducible (also for image re-builders)
66+
echo "IMAGE_COMMIT_DATE=$(date -d @$(git log -1 --pretty=%ct) --iso-8601=seconds)" >> $GITHUB_ENV
67+
echo "IMAGE_OFFICIAL_URL=https://github.com/siemens/debsbom" >> $GITHUB_ENV
68+
shell: bash
69+
70+
- name: Extract metadata
71+
id: meta
72+
uses: docker/metadata-action@v5
73+
with:
74+
annotations: |
75+
org.opencontainers.image.description=${{ env.IMAGE_DESCRIPTION }}
76+
org.opencontainers.image.licenses=MIT
77+
org.opencontainers.image.created=${{ env.IMAGE_COMMIT_DATE }}
78+
org.opencontainers.image.source=${{ env.IMAGE_OFFICIAL_URL }}
79+
org.opencontainers.image.url=${{ env.IMAGE_OFFICIAL_URL }}
80+
env:
81+
DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
82+
83+
- name: Cache apt
84+
id: cache-apt
85+
uses: actions/cache@v4
86+
with:
87+
path: |
88+
var-cache-apt
89+
var-lib-apt
90+
key: cache-apt-${{ env.DEBIAN_TAG }}-${{ inputs.image-name }}
91+
92+
- name: Inject cache into docker
93+
uses: reproducible-containers/buildkit-cache-dance@5b6db76d1da5c8b307d5d2e0706d266521b710de #v3.1.2
94+
with:
95+
cache-map: |
96+
{
97+
"var-cache-apt": "/var/cache/apt",
98+
"var-lib-apt": "/var/lib/apt"
99+
}
100+
skip-extraction: ${{ steps.cache.outputs.cache-hit }}

‎.github/workflows/containers.yml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
# Copyright (C) 2025 Siemens
2+
#
3+
# SPDX-License-Identifier: MIT
4+
name: Containers
5+
6+
on:
7+
push:
8+
9+
jobs:
10+
build_containers:
11+
name: Build, test and deploy container images
12+
needs:
13+
- lint
14+
- test
15+
runs-on: ubuntu-24.04
16+
permissions:
17+
id-token: write
18+
packages: write
19+
contents: read
20+
attestations: write
21+
steps:
22+
- name: Check out repo
23+
uses: actions/checkout@v4
24+
- name: Set up docker build
25+
uses: ./.github/actions/docker-init
26+
with:
27+
deploy-user: ${{ github.actor }}
28+
deploy-token: ${{ secrets.GITHUB_TOKEN }}
29+
30+
- name: Build debsbom image
31+
uses: docker/build-push-action@v6
32+
with:
33+
context: /home/runner/debsbom-clone
34+
target: debsbom
35+
platforms: linux/amd64
36+
build-args: |
37+
SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
38+
DEBIAN_TAG=${{ env.DEBIAN_TAG }}
39+
outputs: type=docker,rewrite-timestamp=true
40+
tags: ghcr.io/${{ github.repository }}/debsbom:test
41+
- name: Test debsbom image
42+
run: |
43+
docker run ghcr.io/${{ github.repository }}/debsbom:test debsbom --version
44+
- name: Complete build and deploy debsbom image
45+
if: github.ref == 'refs/heads/main'
46+
uses: docker/build-push-action@v6
47+
id: push
48+
with:
49+
context: /home/runner/debsbom-clone
50+
target: debsbom
51+
platforms: linux/amd64,linux/arm64
52+
build-args: |
53+
SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
54+
DEBIAN_TAG=${{ env.DEBIAN_TAG }}
55+
provenance: false
56+
outputs: type=registry,rewrite-timestamp=true
57+
tags: ghcr.io/${{ github.repository }}/debsbom:latest
58+
annotations: ${{ env.DOCKER_METADATA_OUTPUT_ANNOTATIONS }}
59+
- name: Attest debsbom image
60+
if: github.ref == 'refs/heads/main'
61+
uses: actions/attest-build-provenance@v1
62+
with:
63+
subject-name: ghcr.io/${{ github.repository }}/debsbom
64+
subject-digest: ${{ steps.push.outputs.digest }}
65+
push-to-registry: true
66+
67+
cleanup_ghcr_containers:
68+
name: cleanup untagged debsbom containers
69+
if: github.ref == 'refs/heads/main'
70+
runs-on: ubuntu-24.04
71+
needs: build_containers
72+
permissions:
73+
packages: write
74+
steps:
75+
- uses: dataaxiom/ghcr-cleanup-action@cd0cdb900b5dbf3a6f2cc869f0dbb0b8211f50c4 #v1.0.16
76+
with:
77+
dry-run: false
78+
validate: true
79+
package: debsbom
80+
token: ${{ secrets.GITHUB_TOKEN }}

‎scripts/lower-bound.py‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/usr/bin/env python3
2+
#
3+
# Copyright (C) 2025 Siemens
4+
#
5+
# SPDX-License-Identifier: MIT
6+
#
7+
# Takes a reverse-sorted, line separated list and
8+
# returns the first element that is equal or smaller
9+
# than the first argument.
10+
11+
import sys
12+
13+
for line in sys.stdin:
14+
if line.rstrip() <= sys.argv[1]:
15+
print(line.rstrip())
16+
break

0 commit comments

Comments
 (0)