fips/.github/workflows/_reusable-docker-build-single.yml at main · goauthentik/fips · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
---
# Re-usable workflow for a single-architecture build
name: Reusable - Single-arch Container build

on:
  workflow_call:
    inputs:
      target_name:
        required: true
        type: string
      registry_ghcr:
        default: true
        type: boolean
      image_suffix:
        default: ""
        type: string
      variables:
        default: ""
        type: string
      image_arch:
        required: true
        type: string
      runs-on:
        required: true
        type: string
      extra_args:
        type: string
        description: Extra args to `docker buildx` command
        default: "--push"
    outputs:
      image-digest:
        value: ${{ jobs.build.outputs.image-digest }}

jobs:
  build:
    name: Build ${{ inputs.image_arch }}
    runs-on: ${{ inputs.runs-on }}
    outputs:
      image-digest: ${{ steps.digest.outputs.full_digest }}
    permissions:
      # Needed to upload container images to ghcr.io
      packages: write
      # Needed for attestation
      id-token: write
      attestations: write
      # Needed for checkout
      contents: read
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
      - if: ${{ inputs.registry_ghcr }}
        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4.0.0
      - id: build
        run: |
          set -xe
          docker buildx create \
            --use \
            --platform=${{ inputs.image_arch }} \
            --name multi-platform-builder \
            --driver-opt env.BUILDKIT_STEP_LOG_MAX_SIZE=50000000
          docker buildx inspect --bootstrap
          docker buildx install
          cache_scope="${{ inputs.target_name }}-${{ inputs.image_arch }}-${{ inputs.variables }}"
          run_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/attempts/${GITHUB_RUN_ATTEMPT}"
          make \
            DOCKER_BUILDX_FLAGS="
              --platform ${{ inputs.image_arch }} \
              ${{ inputs.extra_args }} \
              --attest type=provenance,builder-id=${run_url} \
              --attest type=sbom,disabled=false \
              --cache-from type=gha,ghtoken=${{ secrets.GITHUB_TOKEN }},scope=${cache_scope} \
              --cache-to type=gha,mode=max,ghtoken=${{ secrets.GITHUB_TOKEN }},scope=${cache_scope}" \
            IMAGE_SUFFIX="${{ inputs.image_suffix }}" \
            ARCH="${{ inputs.image_arch }}" \
            ${{ inputs.variables }} \
            ${{ inputs.target_name }}
      - id: digest
        env:
          image: ${{ steps.build.outputs.full }}
        run: |
          docker pull $image
          docker inspect $image
          full_digest=$(docker inspect $image -f "{{ index .RepoDigests 0 }}")
          short_digest=$(echo $full_digest | sed 's/.*@//g')
          echo "full_digest=${full_digest}" >> ${GITHUB_OUTPUT}
          echo "short_digest=${short_digest}" >> ${GITHUB_OUTPUT}
      - uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-name: ${{ steps.build.outputs.image }}
          subject-digest: ${{ steps.digest.outputs.short_digest }}
          push-to-registry: true