-
Notifications
You must be signed in to change notification settings - Fork 40
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
15 changed files
with
328 additions
and
58 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| name: Nightly Build | ||
| on: | ||
| schedule: | ||
| # Random minute number to avoid GH scheduler stampede | ||
| - cron: '37 21 * * *' | ||
| workflow_dispatch: {} | ||
|
|
||
| jobs: | ||
| build-and-publish-images: | ||
| runs-on: ubuntu-22.04 | ||
|
|
||
| permissions: | ||
| contents: read | ||
| id-token: write | ||
| packages: write | ||
|
|
||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
| - name: Setup go | ||
| uses: actions/setup-go@v5 | ||
| with: | ||
| go-version: 1.21.5 | ||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@v3 | ||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
| - name: Install regctl | ||
| uses: regclient/actions/regctl-installer@main | ||
| - name: Build image | ||
| run: make docker-build | ||
| - name: Log in to GHCR | ||
| uses: docker/login-action@v3.0.0 | ||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
| - name: Push images | ||
| run: ./.github/workflows/scripts/push-images.sh nightly |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| #!/usr/bin/env bash | ||
| # shellcheck shell=bash | ||
| ## | ||
| ## USAGE: __PROG__ | ||
| ## | ||
| ## "__PROG__" loads oci tarballs created with xbuild into docker. | ||
| ## | ||
| ## Usage example(s): | ||
| ## ./__PROG__ | ||
| ## PLATFORM=linux/arm64 ./__PROG__ | ||
| ## | ||
| ## Commands | ||
| ## - ./__PROG__ loads the oci tarball into Docker. | ||
|
|
||
| function usage { | ||
| grep '^##' "$0" | sed -e 's/^##//' -e "s/__PROG__/$me/" >&2 | ||
| } | ||
|
|
||
| function normalize_path { | ||
| # Remove all /./ sequences. | ||
| local path=${1//\/.\//\/} | ||
| local npath | ||
| # Remove first dir/.. sequence. | ||
| npath="${path//[^\/][^\/]*\/\.\.\//}" | ||
| # Remove remaining dir/.. sequence. | ||
| while [[ $npath != "$path" ]] ; do | ||
| path=$npath | ||
| npath="${path//[^\/][^\/]*\/\.\.\//}" | ||
| done | ||
| echo "$path" | ||
| } | ||
|
|
||
| me=$(basename "$0") | ||
| BASEDIR=$(dirname "$0") | ||
| ROOTDIR="$(normalize_path "$BASEDIR/../../../")" | ||
|
|
||
| command -v regctl >/dev/null 2>&1 || { usage; echo -e "\n * The regctl cli is required to run this script." >&2 ; exit 1; } | ||
| command -v docker >/dev/null 2>&1 || { usage; echo -e "\n * The docker cli is required to run this script." >&2 ; exit 1; } | ||
|
|
||
| # Takes the current platform architecture or plaftorm as defined externally in a platform variable. | ||
| # e.g.: | ||
| # linux/amd64 | ||
| # linux/arm64 | ||
| PLATFORM="${PLATFORM:-local}" | ||
| OCI_IMAGES=( | ||
| spiffe-helper | ||
| ) | ||
|
|
||
| org_name=$(echo "$GITHUB_REPOSITORY" | tr '/' "\n" | head -1 | tr -d "\n") | ||
| org_name="${org_name:-spiffe}" # default to spiffe in case ran on local | ||
| registry=ghcr.io/${org_name} | ||
|
|
||
| echo "Importing ${OCI_IMAGES[*]} into docker". | ||
| for img in "${OCI_IMAGES[@]}"; do | ||
| oci_dir="ocidir://${ROOTDIR}oci/${img}" | ||
| platform_tar="${img}-${PLATFORM}-image.tar" | ||
| image_to_load="${registry}/${img}:devel" | ||
|
|
||
| # regclient works with directories rather than tars, so import the OCI tar to a directory | ||
| regctl image import "$oci_dir" "${img}-image.tar" | ||
| dig="$(regctl image digest --platform "$PLATFORM" "$oci_dir")" | ||
| # export the single platform image using the digest | ||
| regctl image export "$oci_dir@${dig}" "${platform_tar}" | ||
|
|
||
| docker load < "${platform_tar}" | ||
| docker image tag "localhost/oci/${img}:latest" "${image_to_load}" | ||
| docker image rm "localhost/oci/${img}:latest" | ||
| done |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| #!/usr/bin/env bash | ||
| # shellcheck shell=bash | ||
| ## | ||
| ## USAGE: __PROG__ | ||
| ## | ||
| ## "__PROG__" publishes images to a registry. | ||
| ## | ||
| ## Usage example(s): | ||
| ## ./__PROG__ 1.5.2 | ||
| ## ./__PROG__ v1.5.2 | ||
| ## ./__PROG__ refs/tags/v1.5.2 | ||
| ## | ||
| ## Commands | ||
| ## - ./__PROG__ <version> pushes images to the registry using given version. | ||
|
|
||
| set -e | ||
|
|
||
| function usage { | ||
| grep '^##' "$0" | sed -e 's/^##//' -e "s/__PROG__/$me/" >&2 | ||
| } | ||
|
|
||
| function normalize_path { | ||
| # Remove all /./ sequences. | ||
| local path=${1//\/.\//\/} | ||
| local npath | ||
| # Remove first dir/.. sequence. | ||
| npath="${path//[^\/][^\/]*\/\.\.\//}" | ||
| # Remove remaining dir/.. sequence. | ||
| while [[ $npath != "$path" ]] ; do | ||
| path=$npath | ||
| npath="${path//[^\/][^\/]*\/\.\.\//}" | ||
| done | ||
| echo "$path" | ||
| } | ||
|
|
||
| me=$(basename "$0") | ||
| BASEDIR=$(dirname "$0") | ||
| ROOTDIR="$(normalize_path "$BASEDIR/../../../")" | ||
|
|
||
| version="$1" | ||
| # remove the git tag prefix | ||
| # Push the images using the version tag (without the "v" prefix). | ||
| # Also strips the refs/tags part if the GITHUB_REF variable is used. | ||
| version="${version#refs/tags/v}" | ||
| version="${version#v}" | ||
|
|
||
| if [ -z "${version}" ]; then | ||
| usage | ||
| echo "version not provided!" 1>&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| image=spiffe-helper | ||
| org_name=$(echo "$GITHUB_REPOSITORY" | tr '/' "\n" | head -1 | tr -d "\n") | ||
| org_name="${org_name:-spiffe}" # default to spiffe in case ran outside of GitHub actions | ||
| registry=ghcr.io/${org_name} | ||
| image_to_push="${registry}/${image}:${version}" | ||
| oci_dir="ocidir://${ROOTDIR}oci/${image}" | ||
|
|
||
| echo "Pushing ${image_to_push}." | ||
| regctl image import "${oci_dir}" "${image}-image.tar" | ||
| regctl image copy "${oci_dir}" "${image_to_push}" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -7,3 +7,7 @@ rpm/*.rpm | |
| *.swp | ||
| *.swo | ||
| bootstrap.crt | ||
|
|
||
| # oci image builds | ||
| oci/ | ||
| *-image.tar | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,10 +1,40 @@ | ||
| FROM golang | ||
| # Build the spiffe-helper binary | ||
| ARG go_version | ||
| FROM --platform=$BUILDPLATFORM golang:${go_version}-alpine as base | ||
| WORKDIR /workspace | ||
|
|
||
| WORKDIR /build | ||
| COPY . /build | ||
| RUN CGO_ENABLED=0 go build -o spiffe-helper ./cmd/spiffe-helper | ||
| # Cache deps before building and copying source so that we don't need to re-download as much | ||
| # and so that source changes don't invalidate our downloaded layer | ||
| COPY go.* ./ | ||
| RUN --mount=type=cache,target=/go/pkg/mod go mod download | ||
|
|
||
| # Copy the go source | ||
| COPY cmd/spiffe-helper/main.go cmd/spiffe-helper/main.go | ||
| COPY pkg/ pkg/ | ||
|
|
||
| # xx is a helper for cross-compilation | ||
| # when bumping to a new version analyze the new version for security issues | ||
| # then use crane to lookup the digest of that version so we are immutable | ||
| # crane digest tonistiigi/xx:1.3.0 | ||
| FROM --platform=${BUILDPLATFORM} tonistiigi/xx@sha256:904fe94f236d36d65aeb5a2462f88f2c537b8360475f6342e7599194f291fb7e AS xx | ||
|
|
||
| FROM --platform=${BUILDPLATFORM} base as builder | ||
| ARG TARGETPLATFORM | ||
| ARG TARGETARCH | ||
|
|
||
| ENV CGO_ENABLED=0 | ||
| COPY --link --from=xx / / | ||
| RUN xx-go --wrap | ||
| RUN --mount=type=cache,target=/root/.cache/go-build \ | ||
| --mount=type=cache,target=/go/pkg/mod \ | ||
| go build -o bin/spiffe-helper cmd/spiffe-helper/main.go | ||
|
|
||
| # Use distroless as minimal base image to package the manager binary | ||
| # Refer to https://github.com/GoogleContainerTools/distroless for more details | ||
| #FROM gcr.io/distroless/static:nonroot | ||
| FROM gcr.io/distroless/static AS spiffe-helper | ||
| WORKDIR / | ||
| COPY --link --from=builder /workspace/bin/spiffe-helper /spiffe-helper | ||
|
|
||
| FROM scratch | ||
| COPY --from=0 /build/spiffe-helper /spiffe-helper | ||
| ENTRYPOINT ["/spiffe-helper"] | ||
| CMD ["-config", "/etc/spiffe-helper.conf"] | ||
| CMD [] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.