Skip to content

Commit f097ff2

Browse files
saisatishkarrasaisatishkarra
committed
add checkout for build step
1 parent b937fb2 commit f097ff2

File tree

1 file changed

+43
-49
lines changed

1 file changed

+43
-49
lines changed

‎.github/workflows/release.yaml

+43-49
Original file line numberDiff line numberDiff line change
@@ -16,15 +16,16 @@ on:
1616
env:
1717
# Use docker.io for Docker Hub if empty
1818
REGISTRY: ghcr.io
19-
# github.repository as <account>/<repo>
20-
IMAGE_NAME: ${{ github.repository }}
19+
# Format as <account>/<repo>
20+
# Must be lower case for container tools to parse correctly
21+
IMAGE_NAME: kong/insomnia-mockbin
2122
HAS_ACCESS_TO_GITHUB_TOKEN: ${{ github.repository_owner == 'Kong' }}
2223
# Local docker OCI archive name until the image is pushed to registry
2324
DOCKER_OCI_ARCHIVE: "docker-archive"
2425
# Always use Docker Hub for publishing image signatures
2526
## docker.io/kong/notary - Use Public Notary repository for release image signatures
2627
## docker.io/kong/notary-internal - Use Private Notary repository for internal image signatures
27-
NOTARY_REPOSITORY: format('{0}/{1}', 'docker.io', ${{ github.ref_type == 'tag' && 'kong/notary' || 'kong/notary-internal' }})
28+
NOTARY_REPOSITORY: ${{ github.ref_type == 'tag' && 'kong/notary' || 'kong/notary-internal' }}
2829

2930
jobs:
3031
check:
@@ -56,6 +57,9 @@ jobs:
5657
image_tags: ${{ steps.meta.outputs.tags }}
5758
image_tag_version: ${{ steps.meta.outputs.version }}
5859
steps:
60+
- name: Checkout repository
61+
uses: actions/checkout@v3
62+
5963
# Set up BuildKit Docker container builder to be able to build
6064
# multi-platform images and export cache
6165
# https://github.com/docker/setup-buildx-action
@@ -102,7 +106,6 @@ jobs:
102106
retention-days: 1
103107

104108
scan-images:
105-
name: Scan Images
106109
runs-on: ubuntu-latest
107110
permissions:
108111
contents: read
@@ -111,78 +114,53 @@ jobs:
111114
if: >
112115
github.repository_owner == 'Kong'
113116
&& needs.build-images.result == 'success'
114-
outputs:
115-
image_name: ${{ env.IMAGE_NAME }}
116-
image_manifest_sha: ${{ steps.image_manifest_metadata.outputs.sha }}
117-
notary_repository: ${{ env.NOTARY_REPOSITORY }}
118117
steps:
119118

120119
- name: Download OCI docker TAR artifact
121120
uses: actions/download-artifact@v3
122121
with:
123122
name: ${{ env.DOCKER_OCI_ARCHIVE }}
124-
path: ${{ github.workspace }}/${{ env.DOCKER_OCI_ARCHIVE }}
125-
123+
path: ${{ github.workspace }}
126124
- name: Load OCI docker TAR artifact
127125
run: |
128-
docker load -i ${{ github.workspace }}/${{ env.DOCKER_OCI_ARCHIVE }}/${{ env.DOCKER_OCI_ARCHIVE }}.tar
126+
docker load -i ${{ github.workspace }}/${{ env.DOCKER_OCI_ARCHIVE }}.tar
129127
docker image ls
130128
131-
# Setup regctl to parse platform specific image digest from image manifest
132-
- name: Install regctl
133-
uses: regclient/actions/regctl-installer@main
134-
135-
- name: Parse architecture specific digest from image manifest
136-
id: image_manifest_metadata
137-
run: |
138-
IMAGE=${{ env.IMAGE_NAME }}:${{ needs.build-images.outputs.IMAGE_TAG_VERSION }}
139-
sha="$(regctl image digest "${IMAGE})"
140-
echo "sha=${sha}" >> $GITHUB_OUTPUT
141-
archs=${{ env.PLATFORMS }}
142-
for arch in $(echo "$archs" | sed -e 's/,/ /g'); do
143-
arch=${arch#*/}
144-
echo "Fetching digest for ${arch}..."
145-
sha="$(regctl image digest "${IMAGE}" --platform linux/${arch})"
146-
echo "${arch}_image_sha=${IMAGE}@${sha}"
147-
echo "${arch}_image_sha=${IMAGE}@${sha}" >> $GITHUB_OUTPUT
148-
done
149-
env:
150-
PLATFORMS: "linux/amd64" # Comma separated list of any platforms built
151-
152-
- name: Scan AMD64 Image digest
153-
if: ${{ steps.image_manifest_metadata.outputs.amd64_image_sha != '' }}
129+
- name: Scan the docker OCI Tar ball
154130
id: sbom_action_amd64
155131
uses: Kong/public-shared-actions/security-actions/scan-docker-image@556e4d9756442828427007a7171683a99adf9a6a
156132
with:
157133
asset_prefix: image-${{ env.IMAGE_NAME }}-amd64
158-
image: ${{steps.image_manifest_metadata.outputs.image}}:${{ steps.image_manifest_metadata.outputs.amd64_image_sha }}
134+
image: ${{ env.DOCKER_OCI_ARCHIVE }}.tar
159135
upload-sbom-release-assets: true
160136

161137
release-images:
162-
name: Publish Images
163138
runs-on: ubuntu-latest
164139
permissions:
165140
contents: write
166-
packages: write # needed for signing the images
141+
packages: write # needed for publishing the images
142+
id-token: write # needed for keyless signing of the images
167143
needs: [check, build-images, scan-images]
168144
if: >
169145
github.repository_owner == 'Kong'
170-
&& github.event_name != 'pull_request'
171146
&& needs.scan-images.result == 'success'
172147
env:
173148
IMAGE_TAGS: ${{ needs.build-images.outputs.image_tags }}
174-
IMAGE_MANIFEST_SHA: ${{ needs.scan-images.outputs.image_manifest_sha }}
149+
outputs:
150+
image_name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
151+
image_manifest_sha: ${{ steps.image_manifest_metadata.outputs.image_manifest_sha }}
152+
notary_repository: ${{ env.NOTARY_REPOSITORY }}
175153
steps:
176154

177155
- name: Download OCI docker TAR artifact
178156
uses: actions/download-artifact@v3
179157
with:
180158
name: ${{ env.DOCKER_OCI_ARCHIVE }}
181-
path: ${{ github.workspace }}/${{ env.DOCKER_OCI_ARCHIVE }}
159+
path: ${{ github.workspace }}
182160

183161
- name: Load OCI docker TAR artifact
184162
run: |
185-
docker load -i ${{ github.workspace }}/${{ env.DOCKER_OCI_ARCHIVE }}/${{ env.DOCKER_OCI_ARCHIVE }}.tar
163+
docker load -i ${{ github.workspace }}/${{ env.DOCKER_OCI_ARCHIVE }}.tar
186164
docker image ls
187165
188166
# Login against a Docker registry except on PR
@@ -198,20 +176,36 @@ jobs:
198176
id: publish_images
199177
run: |
200178
for tag in ${IMAGE_TAGS//,/ }; do \
201-
docker push $tag \
179+
docker push $tag; \
202180
done
203181
182+
# Setup regctl to parse platform specific image digest from image manifest
183+
- name: Install regctl
184+
uses: regclient/actions/regctl-installer@main
185+
186+
# The image manifest digest/sha is generated only after the image is published to registry
187+
- name: Parse architecture specific digest from image manifest
188+
id: image_manifest_metadata
189+
run: |
190+
IMAGE=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.build-images.outputs.IMAGE_TAG_VERSION }}
191+
sha="$(regctl image digest "${IMAGE}")"
192+
echo "sha=${sha}" >> $GITHUB_OUTPUT
193+
194+
# Signing images requires image manifest digest
204195
- name: Sign images
205196
id: sign_images
206-
if: ${{ env.IMAGE_MANIFEST_SHA != '' }}
207-
uses: Kong/public-shared-actions/security-actions/sign-docker-image@556e4d9756442828427007a7171683a99adf9a6a # v2.2.1
197+
if: ${{ steps.image_manifest_metadata.outputs.sha != '' }}
198+
uses: Kong/public-shared-actions/security-actions/sign-docker-image@2f02738ecb1670f01391162e43fe3f5d4e7942a1
208199
with:
209-
image_digest: ${{ env.IMAGE_MANIFEST_SHA }}
200+
image_digest: ${{ steps.image_manifest_metadata.outputs.sha }}
210201
tags: ${{ env.IMAGE_TAGS }}
202+
image_registry_domain: ghcr.io
211203
registry_username: ${{ github.actor }}
212204
registry_password: ${{ secrets.GITHUB_TOKEN }}
205+
# Optional: Central notary repository for image signatures
206+
signature_registry_domain: docker.io
213207
signature_registry_username: ${{ secrets.GHA_DOCKERHUB_PUSH_USER }}
214-
signature_registry_password: ${{ secrets.GHA_KONG_ORG_DOCKERHUB_PUSH_TOKEN }}
208+
signature_registry_password: ${{ secrets.GHA_DOCKERHUB_PUSH_TOKEN }}
215209
signature_registry: ${{ env.NOTARY_REPOSITORY }}
216210

217211
release-images-provenance:
@@ -224,9 +218,9 @@ jobs:
224218
actions: read # For getting workflow run info to build provenance
225219
packages: write # Required for publishing provenance. Issue: https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/container#known-issues
226220
with:
227-
image: ${{ needs.scan-images.outputs.image_name }} # Image repository without tag. Eg: kong/insomnia-mockbins
228-
digest: ${{ needs.scan-images.outputs.image_manifest_sha }} # Image manifest digest for the published docker image/TAR
229-
provenance-repository: ${{ needs.scan-images.outputs.notary_repository }}
221+
image: ${{ needs.release-images.outputs.image_name }} # Image repository without tag. Eg: kong/insomnia-mockbins
222+
digest: ${{ needs.release-images.outputs.image_manifest_sha }} # Image manifest digest for the published docker image/TAR
223+
provenance-repository: ${{ needs.release-images.outputs.notary_repository }}
230224
secrets:
231225
registry-username: ${{ github.actor }}
232226
registry-password: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)