129 lines
3.9 KiB
YAML
129 lines
3.9 KiB
YAML
---
|
|
name: publish images
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- '.gitea/workflows/publish-images.yml'
|
|
- 'config/**'
|
|
- 'container/**'
|
|
- 'cmd/**'
|
|
- 'internal/**'
|
|
- 'scripts/**'
|
|
- 'src/**'
|
|
- 'go.mod'
|
|
- 'go.sum'
|
|
- 'pyproject.toml'
|
|
- 'README.md'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
publish-images:
|
|
name: publish-images
|
|
runs-on: [self-hosted, vm]
|
|
timeout-minutes: 45
|
|
permissions:
|
|
contents: read
|
|
env:
|
|
PUSH_REGISTRY: zot-push.ad.ddupan.top
|
|
PULL_REGISTRY: zot.ad.ddupan.top
|
|
CONTROLLER_REPOSITORY: panxiao81/gitea-dynamic-runner-controller
|
|
RUNNER_REPOSITORY: panxiao81/gitea-dynamic-runner-runner
|
|
SPIRE_AGENT_SOCKET: /run/spire/agent-sockets/spire-agent.sock
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Test source
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
go test ./...
|
|
go vet ./...
|
|
python3 -m pip install --break-system-packages -e '.[test]'
|
|
pytest -q
|
|
python3 -m compileall -q src tests
|
|
apt-get update
|
|
apt-get install --yes --no-install-recommends shellcheck
|
|
shellcheck scripts/*
|
|
|
|
- name: Build and publish
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
set +x
|
|
|
|
: "${GITHUB_SHA:?GITHUB_SHA is required}"
|
|
image_tag="sha-${GITHUB_SHA}"
|
|
docker_config=$(mktemp -d)
|
|
jwt_file=$(mktemp)
|
|
cleanup() {
|
|
docker buildx rm ci-builder >/dev/null 2>&1 || true
|
|
rm -rf -- "$docker_config" "$jwt_file"
|
|
}
|
|
trap cleanup EXIT
|
|
export DOCKER_CONFIG="$docker_config"
|
|
|
|
/opt/spire/bin/spire-agent api fetch jwt \
|
|
-audience zot \
|
|
-socketPath "$SPIRE_AGENT_SOCKET" \
|
|
-output json >"$jwt_file"
|
|
# shellcheck disable=SC2016
|
|
jq -er '.[0].svids[0].svid' "$jwt_file" | \
|
|
docker login "$PUSH_REGISTRY" --username zot --password-stdin
|
|
|
|
docker buildx create \
|
|
--name ci-builder \
|
|
--driver docker-container \
|
|
--use
|
|
|
|
publish() {
|
|
local repository=$1
|
|
local dockerfile=$2
|
|
local metadata=$3
|
|
docker buildx build \
|
|
--builder ci-builder \
|
|
--platform linux/amd64 \
|
|
--file "$dockerfile" \
|
|
--tag "${PUSH_REGISTRY}/${repository}:${image_tag}" \
|
|
--tag "${PUSH_REGISTRY}/${repository}:main" \
|
|
--provenance=mode=max \
|
|
--sbom=true \
|
|
--metadata-file "$metadata" \
|
|
--push \
|
|
.
|
|
}
|
|
|
|
publish \
|
|
"$CONTROLLER_REPOSITORY" \
|
|
container/controller.Dockerfile \
|
|
controller-metadata.json
|
|
publish \
|
|
"$RUNNER_REPOSITORY" \
|
|
container/runner.Dockerfile \
|
|
runner-metadata.json
|
|
|
|
controller_digest=$(
|
|
# shellcheck disable=SC2016
|
|
jq -er '."containerimage.digest"' controller-metadata.json
|
|
)
|
|
runner_digest=$(
|
|
# shellcheck disable=SC2016
|
|
jq -er '."containerimage.digest"' runner-metadata.json
|
|
)
|
|
controller_ref="${PULL_REGISTRY}/${CONTROLLER_REPOSITORY}@${controller_digest}"
|
|
runner_ref="${PULL_REGISTRY}/${RUNNER_REPOSITORY}@${runner_digest}"
|
|
|
|
printf 'controller=%s\nrunner=%s\n' "$controller_ref" "$runner_ref"
|
|
if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
|
|
{
|
|
printf '## Published images\n\n'
|
|
# shellcheck disable=SC2016
|
|
printf -- '- Controller: `%s`\n' "$controller_ref"
|
|
# shellcheck disable=SC2016
|
|
printf -- '- Runner: `%s`\n' "$runner_ref"
|
|
# shellcheck disable=SC2016
|
|
printf -- '- Source: `%s`\n' "$GITHUB_SHA"
|
|
} >>"$GITHUB_STEP_SUMMARY"
|
|
fi
|