69 lines
2.0 KiB
Bash
Executable File
69 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
set +x
|
|
|
|
: "${GITHUB_SHA:?GITHUB_SHA is required}"
|
|
: "${IMAGE_NAME:?IMAGE_NAME is required}"
|
|
: "${IMAGE_REPOSITORY:?IMAGE_REPOSITORY is required}"
|
|
: "${IMAGE_DOCKERFILE:?IMAGE_DOCKERFILE is required}"
|
|
: "${PUSH_REGISTRY:?PUSH_REGISTRY is required}"
|
|
: "${PULL_REGISTRY:?PULL_REGISTRY is required}"
|
|
: "${SPIRE_AGENT_SOCKET:?SPIRE_AGENT_SOCKET is required}"
|
|
|
|
# Bootstrap the image that first introduces automatic Docker setup. Once that
|
|
# runner is deployed, the job-started hook makes this an idempotent no-op.
|
|
sudo scripts/setup-job-docker
|
|
|
|
image_tag="sha-${GITHUB_SHA}"
|
|
metadata="${IMAGE_NAME}-metadata.json"
|
|
docker_config=$(mktemp -d)
|
|
jwt_file=$(mktemp)
|
|
cleanup() {
|
|
docker buildx rm ci-builder >/dev/null 2>&1 || true
|
|
rm -rf -- "$docker_config" "$jwt_file"
|
|
}
|
|
trap cleanup EXIT
|
|
export DOCKER_CONFIG="$docker_config"
|
|
|
|
/opt/spire/bin/spire-agent api fetch jwt \
|
|
-audience zot \
|
|
-socketPath "$SPIRE_AGENT_SOCKET" \
|
|
-output json >"$jwt_file"
|
|
# shellcheck disable=SC2016
|
|
jq -er '.[0].svids[0].svid' "$jwt_file" | \
|
|
docker login "$PUSH_REGISTRY" --username zot --password-stdin
|
|
|
|
docker buildx create \
|
|
--name ci-builder \
|
|
--driver docker-container \
|
|
--use
|
|
|
|
docker buildx build \
|
|
--builder ci-builder \
|
|
--platform linux/amd64 \
|
|
--file "$IMAGE_DOCKERFILE" \
|
|
--tag "${PUSH_REGISTRY}/${IMAGE_REPOSITORY}:${image_tag}" \
|
|
--tag "${PUSH_REGISTRY}/${IMAGE_REPOSITORY}:main" \
|
|
--provenance=mode=max \
|
|
--sbom=true \
|
|
--metadata-file "$metadata" \
|
|
--push \
|
|
.
|
|
|
|
image_digest=$(
|
|
# shellcheck disable=SC2016
|
|
jq -er '."containerimage.digest"' "$metadata"
|
|
)
|
|
image_ref="${PULL_REGISTRY}/${IMAGE_REPOSITORY}@${image_digest}"
|
|
|
|
printf '%s=%s\n' "$IMAGE_NAME" "$image_ref"
|
|
if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
|
|
{
|
|
printf '## Published image\n\n'
|
|
# shellcheck disable=SC2016
|
|
printf -- '- %s: `%s`\n' "$IMAGE_NAME" "$image_ref"
|
|
# shellcheck disable=SC2016
|
|
printf -- '- Source: `%s`\n' "$GITHUB_SHA"
|
|
} >>"$GITHUB_STEP_SUMMARY"
|
|
fi
|