Skip to content

Commit 8bcef38

Browse files
saisatishkarrasaisatishkarra
committed
add checkout for build step
1 parent b937fb2 commit 8bcef38

File tree

1 file changed

+42
-47
lines changed

1 file changed

+42
-47
lines changed

‎.github/workflows/release.yaml

+42-47
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,16 @@ on:
1616
env:
1717
# Use docker.io for Docker Hub if empty
1818
REGISTRY: ghcr.io
19-
# github.repository as <account>/<repo>
20-
IMAGE_NAME: ${{ github.repository }}
19+
# Format as <account>/<repo>
20+
# Must be lower case for container tools to parse correctly
21+
IMAGE_NAME: kong/insomnia-mockbin
2122
HAS_ACCESS_TO_GITHUB_TOKEN: ${{ github.repository_owner == 'Kong' }}
2223
# Local docker OCI archive name until the image is pushed to registry
2324
DOCKER_OCI_ARCHIVE: "docker-archive"
2425
# Always use Docker Hub for publishing image signatures
2526
## docker.io/kong/notary - Use Public Notary repository for release image signatures
2627
## docker.io/kong/notary-internal - Use Private Notary repository for internal image signatures
27-
NOTARY_REPOSITORY: format('{0}/{1}', 'docker.io', ${{ github.ref_type == 'tag' && 'kong/notary' || 'kong/notary-internal' }})
28+
NOTARY_REPOSITORY: ${{ github.ref_type == 'tag' && 'kong/notary' || 'kong/notary-internal' }}
2829

2930
jobs:
3031
check:
@@ -56,6 +57,9 @@ jobs:
5657
image_tags: ${{ steps.meta.outputs.tags }}
5758
image_tag_version: ${{ steps.meta.outputs.version }}
5859
steps:
60+
- name: Checkout repository
61+
uses: actions/checkout@v3
62+
5963
# Set up BuildKit Docker container builder to be able to build
6064
# multi-platform images and export cache
6165
# https://github.com/docker/setup-buildx-action
@@ -102,7 +106,6 @@ jobs:
102106
retention-days: 1
103107

104108
scan-images:
105-
name: Scan Images
106109
runs-on: ubuntu-latest
107110
permissions:
108111
contents: read
@@ -111,78 +114,54 @@ jobs:
111114
if: >
112115
github.repository_owner == 'Kong'
113116
&& needs.build-images.result == 'success'
114-
outputs:
115-
image_name: ${{ env.IMAGE_NAME }}
116-
image_manifest_sha: ${{ steps.image_manifest_metadata.outputs.sha }}
117-
notary_repository: ${{ env.NOTARY_REPOSITORY }}
118117
steps:
119118

120119
- name: Download OCI docker TAR artifact
121120
uses: actions/download-artifact@v3
122121
with:
123122
name: ${{ env.DOCKER_OCI_ARCHIVE }}
124-
path: ${{ github.workspace }}/${{ env.DOCKER_OCI_ARCHIVE }}
125-
123+
path: ${{ github.workspace }}
126124
- name: Load OCI docker TAR artifact
127125
run: |
128-
docker load -i ${{ github.workspace }}/${{ env.DOCKER_OCI_ARCHIVE }}/${{ env.DOCKER_OCI_ARCHIVE }}.tar
126+
docker load -i ${{ github.workspace }}/${{ env.DOCKER_OCI_ARCHIVE }}.tar
129127
docker image ls
130128
131-
# Setup regctl to parse platform specific image digest from image manifest
132-
- name: Install regctl
133-
uses: regclient/actions/regctl-installer@main
134-
135-
- name: Parse architecture specific digest from image manifest
136-
id: image_manifest_metadata
137-
run: |
138-
IMAGE=${{ env.IMAGE_NAME }}:${{ needs.build-images.outputs.IMAGE_TAG_VERSION }}
139-
sha="$(regctl image digest "${IMAGE})"
140-
echo "sha=${sha}" >> $GITHUB_OUTPUT
141-
archs=${{ env.PLATFORMS }}
142-
for arch in $(echo "$archs" | sed -e 's/,/ /g'); do
143-
arch=${arch#*/}
144-
echo "Fetching digest for ${arch}..."
145-
sha="$(regctl image digest "${IMAGE}" --platform linux/${arch})"
146-
echo "${arch}_image_sha=${IMAGE}@${sha}"
147-
echo "${arch}_image_sha=${IMAGE}@${sha}" >> $GITHUB_OUTPUT
148-
done
149-
env:
150-
PLATFORMS: "linux/amd64" # Comma separated list of any platforms built
151-
152-
- name: Scan AMD64 Image digest
153-
if: ${{ steps.image_manifest_metadata.outputs.amd64_image_sha != '' }}
129+
- name: Scan the docker OCI Tar ball
154130
id: sbom_action_amd64
155131
uses: Kong/public-shared-actions/security-actions/scan-docker-image@556e4d9756442828427007a7171683a99adf9a6a
156132
with:
157133
asset_prefix: image-${{ env.IMAGE_NAME }}-amd64
158-
image: ${{steps.image_manifest_metadata.outputs.image}}:${{ steps.image_manifest_metadata.outputs.amd64_image_sha }}
134+
image: ${{ env.DOCKER_OCI_ARCHIVE }}.tar
159135
upload-sbom-release-assets: true
160136

161137
release-images:
162-
name: Publish Images
163138
runs-on: ubuntu-latest
164139
permissions:
165140
contents: write
166-
packages: write # needed for signing the images
141+
packages: write # needed for publishing the images
142+
id-token: write # needed for keyless signing of the images
167143
needs: [check, build-images, scan-images]
168144
if: >
169145
github.repository_owner == 'Kong'
170146
&& github.event_name != 'pull_request'
171147
&& needs.scan-images.result == 'success'
172148
env:
173149
IMAGE_TAGS: ${{ needs.build-images.outputs.image_tags }}
174-
IMAGE_MANIFEST_SHA: ${{ needs.scan-images.outputs.image_manifest_sha }}
150+
outputs:
151+
image_name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
152+
image_manifest_sha: ${{ steps.image_manifest_metadata.outputs.image_manifest_sha }}
153+
notary_repository: ${{ env.NOTARY_REPOSITORY }}
175154
steps:
176155

177156
- name: Download OCI docker TAR artifact
178157
uses: actions/download-artifact@v3
179158
with:
180159
name: ${{ env.DOCKER_OCI_ARCHIVE }}
181-
path: ${{ github.workspace }}/${{ env.DOCKER_OCI_ARCHIVE }}
160+
path: ${{ github.workspace }}
182161

183162
- name: Load OCI docker TAR artifact
184163
run: |
185-
docker load -i ${{ github.workspace }}/${{ env.DOCKER_OCI_ARCHIVE }}/${{ env.DOCKER_OCI_ARCHIVE }}.tar
164+
docker load -i ${{ github.workspace }}/${{ env.DOCKER_OCI_ARCHIVE }}.tar
186165
docker image ls
187166
188167
# Login against a Docker registry except on PR
@@ -198,18 +177,34 @@ jobs:
198177
id: publish_images
199178
run: |
200179
for tag in ${IMAGE_TAGS//,/ }; do \
201-
docker push $tag \
180+
docker push $tag; \
202181
done
203182
183+
# Setup regctl to parse platform specific image digest from image manifest
184+
- name: Install regctl
185+
uses: regclient/actions/regctl-installer@main
186+
187+
# The image manifest digest/sha is generated only after the image is published to registry
188+
- name: Parse architecture specific digest from image manifest
189+
id: image_manifest_metadata
190+
run: |
191+
IMAGE=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.build-images.outputs.IMAGE_TAG_VERSION }}
192+
sha="$(regctl image digest "${IMAGE}")"
193+
echo "sha=${sha}" >> $GITHUB_OUTPUT
194+
195+
# Signing images requires image manifest digest
204196
- name: Sign images
205197
id: sign_images
206-
if: ${{ env.IMAGE_MANIFEST_SHA != '' }}
207-
uses: Kong/public-shared-actions/security-actions/sign-docker-image@556e4d9756442828427007a7171683a99adf9a6a # v2.2.1
198+
if: ${{ steps.image_manifest_metadata.outputs.sha != '' }}
199+
uses: Kong/public-shared-actions/security-actions/sign-docker-image@fix/image-sig-registry-opts # v2.2.1
208200
with:
209-
image_digest: ${{ env.IMAGE_MANIFEST_SHA }}
201+
image_digest: ${{ steps.image_manifest_metadata.outputs.sha }}
210202
tags: ${{ env.IMAGE_TAGS }}
203+
image_registry_domain: ghcr.io
211204
registry_username: ${{ github.actor }}
212205
registry_password: ${{ secrets.GITHUB_TOKEN }}
206+
# Optional: Central notary repository for image signatures
207+
signature_registry_domain: docker.io
213208
signature_registry_username: ${{ secrets.GHA_DOCKERHUB_PUSH_USER }}
214209
signature_registry_password: ${{ secrets.GHA_KONG_ORG_DOCKERHUB_PUSH_TOKEN }}
215210
signature_registry: ${{ env.NOTARY_REPOSITORY }}
@@ -224,9 +219,9 @@ jobs:
224219
actions: read # For getting workflow run info to build provenance
225220
packages: write # Required for publishing provenance. Issue: https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/container#known-issues
226221
with:
227-
image: ${{ needs.scan-images.outputs.image_name }} # Image repository without tag. Eg: kong/insomnia-mockbins
228-
digest: ${{ needs.scan-images.outputs.image_manifest_sha }} # Image manifest digest for the published docker image/TAR
229-
provenance-repository: ${{ needs.scan-images.outputs.notary_repository }}
222+
image: ${{ needs.release-images.outputs.image_name }} # Image repository without tag. Eg: kong/insomnia-mockbins
223+
digest: ${{ needs.release-images.outputs.image_manifest_sha }} # Image manifest digest for the published docker image/TAR
224+
provenance-repository: ${{ needs.release-images.outputs.notary_repository }}
230225
secrets:
231226
registry-username: ${{ github.actor }}
232227
registry-password: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)