.github/.github/workflows/reusable_dockerfile_pipeline.yml at file-sync · evstack/.github

Repository navigation

View runs

History

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

name: Docker Build & Publish

on:

workflow_call:

inputs:

dockerfile:

required: false

type: string

description: "Path to Dockerfile"

default: "Dockerfile"

packageName:

required: false

type: string

description: "You can specify a different package name."

dockerContext:

required: false

type: string

description: "The docker context"

default: "."

env:

GITHUB_REG: ghcr.io

MAINTAINER: ${{ github.repository_owner }}

DESCRIPTION: "${{ github.repository_owner }} repository ${{ github.repository }}"

jobs:

prepare-env:

runs-on: "ubuntu-latest"

outputs:

repo_owner: ${{ steps.setting_env.outputs.repo_owner }}

output_short_sha: ${{ steps.setting_env.outputs.short_sha }}

output_image_name: ${{ steps.setting_env.outputs.image_name }}

build_for_pr: ${{ steps.setting_logic.outputs.build_for_pr }}

build_for_merge: ${{ steps.setting_logic.outputs.build_for_merge }}

not_a_fork: ${{ steps.setting_logic.outputs.not_a_fork }}

steps:

- name: Checkout

uses: "actions/checkout@v4"

- name: Add vars to ENV

id: setting_env

run: |

# Extract both the repository owner and repository name

# According to docs, github.repository is in the format of owner/repo, not just repo

# https://docs.github.com/en/actions/learn-github-actions/contexts#github-context

REPO_OWNER=$(echo "${{ github.repository }}" | awk -F'/' '{print $1}' | tr '[:upper:]' '[:lower:]')

REPO_NAME=$(echo "${{ github.repository }}" | awk -F'/' '{print $2}' | tr '[:upper:]' '[:lower:]')

# Check repo name for .github use to test this workflow

if [[ $REPO_NAME == ".github" ]]; then

# Remove the leading . to avoid failing the character check

REPO_NAME="github"

# Log variables for debugging

echo "Repository Owner: $REPO_OWNER"

echo "Repository Name: $REPO_NAME"

echo "INPUT PACKAGE NAME: ${{ inputs.packageName }}"

# Set environment variables and outputs

echo "REPO_OWNER=$REPO_OWNER" >> $GITHUB_ENV

echo "repo_owner=$REPO_OWNER" >> "$GITHUB_OUTPUT"

echo "SHORT_SHA=`echo ${GITHUB_SHA} | cut -c1-8`" >> $GITHUB_ENV

echo "short_sha=`echo ${GITHUB_SHA} | cut -c1-8`" >> "$GITHUB_OUTPUT"

if [[ "${{ inputs.packageName }}" == "${{ github.repository }}" ]]; then

# If a user submitted package name that has the naming containing

# both the repository owner and repository name, we fail

# e.g: inputs.packageName = "rollkit/rollkit" is not allowed, just submit rollkit

echo "------------------------------------------------------------"

echo "ERROR: Package name not valid! => [ ${{ inputs.packageName }} ]"

echo "Don't use the repository owner and repository name in the package name."

echo "------------------------------------------------------------"

exit 1

# Set the default package name to the repository name

PACKAGE_NAME=$REPO_NAME

# If there is a user submitted package name, use it

if [[ -n "${{ inputs.packageName }}" ]]; then

PACKAGE_NAME=$(echo "${{ inputs.packageName }}" | tr '[:upper:]' '[:lower:]')

# validate the package name characters

if [[ ! $PACKAGE_NAME =~ ^[A-Za-z0-9\-]+$ ]]; then

echo "------------------------------------------------------------"

echo "ERROR: Package name not valid! => [ $PACKAGE_NAME ]"

echo "ONLY can use: A-Za-z0-9\-"

echo "------------------------------------------------------------"

exit 1

# Log the package name for debugging

echo "PACKAGE_NAME: $PACKAGE_NAME"

# Set environment variables and outputs

echo "IMAGE_NAME=$PACKAGE_NAME" >> $GITHUB_ENV

echo "image_name=$PACKAGE_NAME" >> "$GITHUB_OUTPUT"

# The key logic that we want to determine is whether or not we are working

# on a fork and if this is a pull request or merge to main.

# We care about forks because of github's security policies that prevent

# forks from pushing images. So we only want to build images on forks

# The distinction between pull requests and merges to main is that on pull

# requests we want a single image available quickly for testing. On merges

# to main we want all the images built and are ok waiting longer to ensure

# there are not bugs.

- name: Add logic to ENV

id: setting_logic

run: |

# yamllint disable

echo "build_for_pr=${{ github.event_name == 'pull_request' }}" >> "$GITHUB_OUTPUT"

echo "build_for_merge=${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v') }}" >> "$GITHUB_OUTPUT"

echo "not_a_fork=${{ github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name }}" >> "$GITHUB_OUTPUT"

# yamllint enable

# Log the key inputs to the logic as well a the outputs. We check that

# build_for_pr and build_for_merge are never equal when they are true as that

# would indicate a bug. If they are both false, this is ok, as this is the

# case on pushing commits to a PR.

logic-check:

needs: prepare-env

runs-on: "ubuntu-latest"

steps:

- name: Log logic

run: |

echo "github.event_name: ${{ github.event_name }}"

echo "github.ref: ${{ github.ref }}"

echo "head repo: ${{ github.event.pull_request.head.repo.full_name }}"

echo "base repo: ${{ github.event.pull_request.base.repo.full_name }}"

echo "build_for_pr: ${{ needs.prepare-env.outputs.build_for_pr }}"

echo "build_for_merge: ${{ needs.prepare-env.outputs.build_for_merge }}"

echo "not_a_fork: ${{ needs.prepare-env.outputs.not_a_fork }}"

- name: Check logic

if: |

(needs.prepare-env.outputs.build_for_pr == needs.prepare-env.outputs.build_for_merge)

&& needs.prepare-env.outputs.build_for_pr != 'false'

run: |

echo "Failing step due to build_for_pr == build_for_merge"

exit 1

# docker-security:

# needs: ["prepare-env", "logic-check"]

# runs-on: "ubuntu-latest"

# steps:

# - name: Checkout

# uses: "actions/checkout@v4"

# - name: Build

# uses: docker/build-push-action@v6

# env:

# OUTPUT_SHORT_SHA: ${{ needs.prepare-env.outputs.output_short_sha }}

# OUTPUT_IMAGE_NAME: ${{ needs.prepare-env.outputs.output_image_name }}

# with:

# context: ${{ inputs.dockerContext}}

# push: false

# platforms: linux/amd64

# # we're building the container before the scan, use the short sha tag

# # for referring to it later

# tags: ${{ env.OUTPUT_IMAGE_NAME }}:${{ env.OUTPUT_SHORT_SHA }}

# file: ${{ inputs.dockerfile }}

# - name: Run Trivy vulnerability scanner

# # source: https://github.com/aquasecurity/trivy-action

# # https://github.com/marketplace/actions/aqua-security-trivy

# uses: aquasecurity/trivy-action@master

# env:

# OUTPUT_SHORT_SHA: ${{ needs.prepare-env.outputs.output_short_sha }}

# OUTPUT_IMAGE_NAME: ${{ needs.prepare-env.outputs.output_image_name }}

# with:

# # here we use the local tag that we've built before

# image-ref: "${{ env.OUTPUT_IMAGE_NAME }}:${{ env.OUTPUT_SHORT_SHA }}"

# format: "table"

# #exit-code: '1' # uncomment to stop the CI if the scanner fails

# ignore-unfixed: true

# vuln-type: "os,library"

# severity: "CRITICAL,HIGH"

docker-build:

name: docker-build (${{ matrix.registry.name }}; ${{ matrix.registry.registry-url }}/${{ matrix.registry.registry-owner }}/${{ needs.prepare-env.outputs.output_image_name }})

runs-on: "ubuntu-latest"

# wait until the jobs are finished.

needs: ["prepare-env", "logic-check"]

# We only want to run this step if one of the build flags is true. We don't

# run if both logic flags are false. This is the case for push events on PR

# commits. The logic-check job protects us from the case of both build flags

# being equal to true.

if: |

needs.prepare-env.outputs.build_for_pr == 'true'

|| needs.prepare-env.outputs.build_for_merge == 'true'

permissions:

contents: write

packages: write

strategy:

matrix:

# run-on-pr is used to skip running registries that are expected to fail

# due to github permission issues with org wide secrets.

registry:

# - name: DockerHub

# user-secret: DOCKERHUB_USERNAME

# token-secret: DOCKERHUB_TOKEN

# registry-url: docker.io

# registry-owner: rollkitorg

# run-on-pr: "false"

- name: GHCR

user-secret: ${{ github.repository_owner }}

token-secret: GITHUB_TOKEN

registry-url: ghcr.io

registry-owner: ${{ needs.prepare-env.outputs.repo_owner }}

run-on-pr: "true"

# - name: ScaleWay

# user-secret: SCALEWAY_USERNAME

# token-secret: SCW_SECRET_KEY

# registry-url: rg.fr-par.scw.cloud

# registry-owner: rollkitorg

# run-on-pr: "false"

fail-fast: false

steps:

- name: Check run conditions

id: run_check

# We only want to run when the registry is able to run on PR or if it is a merge event

run: echo "run=${{ matrix.registry.run-on-pr == needs.prepare-env.outputs.build_for_pr || needs.prepare-env.outputs.build_for_merge == 'true'}}" >> "$GITHUB_OUTPUT"

- name: Checkout

if: ${{ steps.run_check.outputs.run == 'true'}}

uses: "actions/checkout@v4"

- name: Login to ${{ matrix.registry.name }}

if: ${{ steps.run_check.outputs.run == 'true'}}

uses: docker/login-action@v3

with:

registry: ${{ matrix.registry.registry-url }}

username: ${{ matrix.registry.registry-url == env.GITHUB_REG && matrix.registry.user-secret || secrets[matrix.registry.user-secret] }}

password: ${{ secrets[matrix.registry.token-secret] }}

- name: Extract Docker Metadata

if: ${{ steps.run_check.outputs.run == 'true'}}

id: meta

uses: docker/metadata-action@v5

env:

OUTPUT_SHORT_SHA: ${{ needs.prepare-env.outputs.output_short_sha }}

OUTPUT_IMAGE_NAME: ${{ needs.prepare-env.outputs.output_image_name }}

with:

images: ${{ matrix.registry.registry-url }}/${{ matrix.registry.registry-owner }}/${{ env.OUTPUT_IMAGE_NAME }}

# yamllint disable

labels: |

maintainer=${{ env.MAINTAINER }}

commitUrl=https://github.com/${{ github.repository }}/commit/${{ github.sha }}

dockerPull=docker pull ${{ matrix.registry.registry-url }}/${{ matrix.registry.registry-owner }}/${{ env.OUTPUT_IMAGE_NAME }}:${{ env.OUTPUT_SHORT_SHA }}

org.opencontainers.image.description=${{ env.DESCRIPTION }}

tags: |

# output minimal (short sha)

type=raw,value={{sha}}

# output v0.2.1/v*-* (or sha of no tag)

type=semver,pattern={{raw}}

# pull request event

type=ref,enable=true,prefix=pr-,suffix=,event=pr

# yamllint enable

- name: Set up QEMU

if: ${{ steps.run_check.outputs.run == 'true'}}

uses: docker/setup-qemu-action@v3

- name: Set up Docker Buildx

if: ${{ steps.run_check.outputs.run == 'true'}}

uses: docker/setup-buildx-action@v3

- name: "Build and Push amd64 Docker Image"

if: ${{ steps.run_check.outputs.run == 'true'}}

uses: docker/build-push-action@v6

env:

OUTPUT_SHORT_SHA: ${{ needs.prepare-env.outputs.output_short_sha }}

OUTPUT_IMAGE_NAME: ${{ needs.prepare-env.outputs.output_image_name }}

with:

context: ${{ inputs.dockerContext}}

platforms: linux/amd64

provenance: false

# Only push if the head and base repos match, meaning it is not a fork

push: ${{ needs.prepare-env.outputs.not_a_fork == 'true' }}

tags: ${{ steps.meta.outputs.tags }}

labels: ${{ steps.meta.outputs.labels }}

file: ${{ inputs.dockerfile }}

FilesExpand file tree

reusable_dockerfile_pipeline.yml

Latest commit

History

reusable_dockerfile_pipeline.yml

File metadata and controls