|
|
|
@ -44,12 +44,6 @@ jobs: |
|
|
|
id-token: write # Needed to mint the OIDC token necessary to request a Sigstore signing certificate |
|
|
|
runs-on: ${{ contains(matrix.arch, 'arm') && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }} |
|
|
|
timeout-minutes: 120 |
|
|
|
# Start a local docker registry to extract the compiled binaries to upload as artifacts and attest them |
|
|
|
services: |
|
|
|
registry: |
|
|
|
image: registry@sha256:1fc7de654f2ac1247f0b67e8a459e273b0993be7d2beda1f3f56fbf1001ed3e7 # v3.0.0 |
|
|
|
ports: |
|
|
|
- 5000:5000 |
|
|
|
env: |
|
|
|
SOURCE_COMMIT: ${{ github.sha }} |
|
|
|
SOURCE_REPOSITORY_URL: "https://github.com/${{ github.repository }}" |
|
|
|
@ -57,8 +51,6 @@ jobs: |
|
|
|
matrix: |
|
|
|
arch: ["amd64", "arm64", "arm/v7", "arm/v6"] |
|
|
|
base_image: ["debian","alpine"] |
|
|
|
outputs: |
|
|
|
base-tags: ${{ steps.determine-version.outputs.BASE_TAGS }} |
|
|
|
|
|
|
|
steps: |
|
|
|
- name: Initialize QEMU binfmt support |
|
|
|
@ -96,19 +88,9 @@ jobs: |
|
|
|
NORMALIZED_ARCH="${MATRIX_ARCH//\/}" |
|
|
|
echo "NORMALIZED_ARCH=${NORMALIZED_ARCH}" | tee -a "${GITHUB_ENV}" |
|
|
|
|
|
|
|
# Determine Base Tags and Source Version |
|
|
|
- name: Determine Base Tags and Source Version |
|
|
|
id: determine-version |
|
|
|
env: |
|
|
|
REF_TYPE: ${{ github.ref_type }} |
|
|
|
# Determine Source Version |
|
|
|
- name: Determine Source Version |
|
|
|
run: | |
|
|
|
# Check which main tag we are going to build determined by ref_type |
|
|
|
if [[ "${REF_TYPE}" == "tag" ]]; then |
|
|
|
echo "BASE_TAGS=latest,${GITHUB_REF#refs/*/}" | tee -a "${GITHUB_OUTPUT}" |
|
|
|
elif [[ "${REF_TYPE}" == "branch" ]]; then |
|
|
|
echo "BASE_TAGS=testing" | tee -a "${GITHUB_OUTPUT}" |
|
|
|
fi |
|
|
|
|
|
|
|
# Get the Source Version for this release |
|
|
|
GIT_EXACT_TAG="$(git describe --tags --abbrev=0 --exact-match 2>/dev/null || true)" |
|
|
|
if [[ -n "${GIT_EXACT_TAG}" ]]; then |
|
|
|
@ -117,7 +99,6 @@ jobs: |
|
|
|
GIT_LAST_TAG="$(git describe --tags --abbrev=0)" |
|
|
|
echo "SOURCE_VERSION=${GIT_LAST_TAG}-${SOURCE_COMMIT:0:8}" | tee -a "${GITHUB_ENV}" |
|
|
|
fi |
|
|
|
# End Determine Base Tags |
|
|
|
|
|
|
|
# Login to Docker Hub |
|
|
|
- name: Login to Docker Hub |
|
|
|
@ -183,10 +164,6 @@ jobs: |
|
|
|
fi |
|
|
|
# |
|
|
|
|
|
|
|
- name: Add localhost registry |
|
|
|
run: | |
|
|
|
echo "CONTAINER_REGISTRIES=${CONTAINER_REGISTRIES:+${CONTAINER_REGISTRIES},}localhost:5000/vaultwarden/server" | tee -a "${GITHUB_ENV}" |
|
|
|
|
|
|
|
- name: Generate tags |
|
|
|
id: tags |
|
|
|
env: |
|
|
|
@ -220,6 +197,7 @@ jobs: |
|
|
|
*.cache-to=${{ env.BAKE_CACHE_TO }} |
|
|
|
*.platform=linux/${{ matrix.arch }} |
|
|
|
${{ env.TAGS }} |
|
|
|
*.output=type=local,dest=./output |
|
|
|
*.output=type=image,push-by-digest=true,name-canonical=true,push=true |
|
|
|
|
|
|
|
- name: Extract digest SHA |
|
|
|
@ -247,33 +225,11 @@ jobs: |
|
|
|
if-no-files-found: error |
|
|
|
retention-days: 1 |
|
|
|
|
|
|
|
# Extract the Alpine binaries from the containers |
|
|
|
- name: Extract binaries |
|
|
|
- name: Rename binaries to match target platform |
|
|
|
env: |
|
|
|
REF_TYPE: ${{ github.ref_type }} |
|
|
|
BASE_IMAGE: ${{ matrix.base_image }} |
|
|
|
DIGEST_SHA: ${{ env.DIGEST_SHA }} |
|
|
|
NORMALIZED_ARCH: ${{ env.NORMALIZED_ARCH }} |
|
|
|
run: | |
|
|
|
# Check which main tag we are going to build determined by ref_type |
|
|
|
if [[ "${REF_TYPE}" == "tag" ]]; then |
|
|
|
EXTRACT_TAG="latest" |
|
|
|
elif [[ "${REF_TYPE}" == "branch" ]]; then |
|
|
|
EXTRACT_TAG="testing" |
|
|
|
fi |
|
|
|
|
|
|
|
# Check which base_image was used and append -alpine if needed |
|
|
|
if [[ "${BASE_IMAGE}" == "alpine" ]]; then |
|
|
|
EXTRACT_TAG="${EXTRACT_TAG}-alpine" |
|
|
|
fi |
|
|
|
|
|
|
|
CONTAINER_ID="$(docker create "localhost:5000/vaultwarden/server:${EXTRACT_TAG}@${DIGEST_SHA}")" |
|
|
|
|
|
|
|
# Copy the binary |
|
|
|
docker cp "$CONTAINER_ID":/vaultwarden vaultwarden-"${NORMALIZED_ARCH}" |
|
|
|
|
|
|
|
# Clean up |
|
|
|
docker rm "$CONTAINER_ID" |
|
|
|
mv ./output/vaultwarden vaultwarden-"${NORMALIZED_ARCH}" |
|
|
|
|
|
|
|
# Upload artifacts to Github Actions and Attest the binaries |
|
|
|
- name: Attest binaries |
|
|
|
@ -291,15 +247,10 @@ jobs: |
|
|
|
name: Merge manifests |
|
|
|
runs-on: ubuntu-latest |
|
|
|
needs: docker-build |
|
|
|
|
|
|
|
env: |
|
|
|
BASE_TAGS: ${{ needs.docker-build.outputs.base-tags }} |
|
|
|
|
|
|
|
permissions: |
|
|
|
packages: write # Needed to upload packages and artifacts |
|
|
|
attestations: write # Needed to generate an artifact attestation for a build |
|
|
|
id-token: write # Needed to mint the OIDC token necessary to request a Sigstore signing certificate |
|
|
|
|
|
|
|
strategy: |
|
|
|
matrix: |
|
|
|
base_image: ["debian","alpine"] |
|
|
|
@ -359,6 +310,18 @@ jobs: |
|
|
|
run: | |
|
|
|
echo "CONTAINER_REGISTRIES=${CONTAINER_REGISTRIES:+${CONTAINER_REGISTRIES},}${QUAY_REPO}" | tee -a "${GITHUB_ENV}" |
|
|
|
|
|
|
|
# Determine Base Tags |
|
|
|
- name: Determine Base Tags |
|
|
|
env: |
|
|
|
REF_TYPE: ${{ github.ref_type }} |
|
|
|
run: | |
|
|
|
# Check which main tag we are going to build determined by ref_type |
|
|
|
if [[ "${REF_TYPE}" == "tag" ]]; then |
|
|
|
echo "BASE_TAGS=latest,${GITHUB_REF#refs/*/}" | tee -a "${GITHUB_ENV}" |
|
|
|
elif [[ "${REF_TYPE}" == "branch" ]]; then |
|
|
|
echo "BASE_TAGS=testing" | tee -a "${GITHUB_ENV}" |
|
|
|
fi |
|
|
|
|
|
|
|
- name: Create manifest list, push it and extract digest SHA |
|
|
|
working-directory: ${{ runner.temp }}/digests |
|
|
|
env: |
|
|
|
|
Henning
2 weeks ago
GitHub