162 lines
6.3 KiB
YAML
162 lines
6.3 KiB
YAML
name: Build
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
schedule:
|
|
- cron: "0 0 * * 1"
|
|
|
|
permissions:
|
|
contents: read
|
|
# packages: write # not yet supported by Gitea
|
|
|
|
jobs:
|
|
base:
|
|
name: Base Image
|
|
runs-on: logaldeveloper-archlinux-ci
|
|
outputs:
|
|
version_tag: ${{ steps.metadata.outputs.version_tag }}
|
|
base_digest: ${{ steps.build-image.outputs.digest }}
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
|
|
with:
|
|
driver-opts: network=host
|
|
|
|
- name: Log in to Gitea Container Registry
|
|
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
|
|
with:
|
|
registry: git.logal.dev
|
|
username: ${{ gitea.repository_owner }}
|
|
password: ${{ secrets.REGISTRY_PASSWORD }}
|
|
|
|
- name: Build rootfs
|
|
working-directory: archlinux-base
|
|
run: bash build-rootfs.sh
|
|
|
|
- name: Package rootfs
|
|
working-directory: archlinux-base
|
|
run: |
|
|
tar --numeric-owner --acls --xattrs \
|
|
--directory build/rootfs \
|
|
--create \
|
|
--file build/rootfs.tar \
|
|
.
|
|
rm -rf build/rootfs
|
|
|
|
- name: Generate image metadata
|
|
id: metadata
|
|
run: |
|
|
version_tag=$(date -u +%Y%m%d).${{ gitea.run_number }}
|
|
created=$(date -u +%Y-%m-%dT%H:%M:%SZ)
|
|
printf 'created=%s\n' "$created" | tee -a "$GITEA_OUTPUT"
|
|
printf 'version_tag=%s\n' "$version_tag" | tee -a "$GITEA_OUTPUT"
|
|
|
|
- name: Build image
|
|
id: build-image
|
|
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
|
|
with:
|
|
context: archlinux-base
|
|
network: host
|
|
push: true
|
|
build-args: |
|
|
OCI_CREATED=${{ steps.metadata.outputs.created }}
|
|
OCI_REVISION=${{ gitea.sha }}
|
|
OCI_VERSION=${{ steps.metadata.outputs.version_tag }}
|
|
tags: |
|
|
git.logal.dev/logaldeveloper/archlinux-base:${{ steps.metadata.outputs.version_tag }}
|
|
git.logal.dev/logaldeveloper/archlinux-base:latest
|
|
|
|
- name: Generate SBOM
|
|
working-directory: archlinux-base
|
|
env:
|
|
SYFT_CHECK_FOR_APP_UPDATE: "false"
|
|
run: |
|
|
syft scan registry:git.logal.dev/logaldeveloper/archlinux-base:${{ steps.metadata.outputs.version_tag }} \
|
|
--override-default-catalogers alpm-db-cataloger \
|
|
--source-name git.logal.dev/logaldeveloper/archlinux-base \
|
|
--source-version "${{ steps.metadata.outputs.version_tag }}" \
|
|
--output syft-table \
|
|
--output cyclonedx-json=archlinux-base-${{ steps.metadata.outputs.version_tag }}.cyclonedx.json
|
|
sha256sum archlinux-base-${{ steps.metadata.outputs.version_tag }}.cyclonedx.json
|
|
zstd -T0 --ultra -22 \
|
|
archlinux-base-${{ steps.metadata.outputs.version_tag }}.cyclonedx.json
|
|
|
|
- name: Upload SBOM artifact
|
|
uses: christopherhx/gitea-upload-artifact@8818363695ca2d5782c64f6453273341374767b7 # v7
|
|
with:
|
|
name: archlinux-base-cyclonedx-${{ steps.metadata.outputs.version_tag }}
|
|
path: archlinux-base/archlinux-base-${{ steps.metadata.outputs.version_tag }}.cyclonedx.json.zst
|
|
if-no-files-found: error
|
|
archive: "false"
|
|
|
|
ci:
|
|
name: CI Image
|
|
needs: base
|
|
runs-on: logaldeveloper-archlinux-ci
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
|
|
with:
|
|
driver-opts: network=host
|
|
|
|
- name: Log in to Gitea Container Registry
|
|
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
|
|
with:
|
|
registry: git.logal.dev
|
|
username: ${{ gitea.repository_owner }}
|
|
password: ${{ secrets.REGISTRY_PASSWORD }}
|
|
|
|
- name: Generate image metadata
|
|
id: metadata
|
|
run: |
|
|
version_tag="${{ needs.base.outputs.version_tag }}"
|
|
created=$(date -u +%Y-%m-%dT%H:%M:%SZ)
|
|
printf 'created=%s\n' "$created" | tee -a "$GITEA_OUTPUT"
|
|
printf 'version_tag=%s\n' "$version_tag" | tee -a "$GITEA_OUTPUT"
|
|
|
|
- name: Build image
|
|
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
|
|
with:
|
|
context: archlinux-ci
|
|
network: host
|
|
push: true
|
|
build-args: |
|
|
ARCHLINUX_BASE_IMAGE=git.logal.dev/logaldeveloper/archlinux-base:${{ steps.metadata.outputs.version_tag }}
|
|
OCI_BASE_DIGEST=${{ needs.base.outputs.base_digest }}
|
|
OCI_CREATED=${{ steps.metadata.outputs.created }}
|
|
OCI_REVISION=${{ gitea.sha }}
|
|
OCI_VERSION=${{ steps.metadata.outputs.version_tag }}
|
|
tags: |
|
|
git.logal.dev/logaldeveloper/archlinux-ci:${{ steps.metadata.outputs.version_tag }}
|
|
git.logal.dev/logaldeveloper/archlinux-ci:latest
|
|
|
|
- name: Generate SBOM
|
|
working-directory: archlinux-ci
|
|
env:
|
|
SYFT_CHECK_FOR_APP_UPDATE: "false"
|
|
run: |
|
|
syft scan registry:git.logal.dev/logaldeveloper/archlinux-ci:${{ steps.metadata.outputs.version_tag }} \
|
|
--override-default-catalogers alpm-db-cataloger \
|
|
--source-name git.logal.dev/logaldeveloper/archlinux-ci \
|
|
--source-version "${{ steps.metadata.outputs.version_tag }}" \
|
|
--output syft-table \
|
|
--output cyclonedx-json=archlinux-ci-${{ steps.metadata.outputs.version_tag }}.cyclonedx.json
|
|
sha256sum archlinux-ci-${{ steps.metadata.outputs.version_tag }}.cyclonedx.json
|
|
zstd -T0 --ultra -22 \
|
|
archlinux-ci-${{ steps.metadata.outputs.version_tag }}.cyclonedx.json
|
|
|
|
- name: Upload SBOM artifact
|
|
uses: christopherhx/gitea-upload-artifact@8818363695ca2d5782c64f6453273341374767b7 # v7
|
|
with:
|
|
name: archlinux-ci-cyclonedx-${{ steps.metadata.outputs.version_tag }}
|
|
path: archlinux-ci/archlinux-ci-${{ steps.metadata.outputs.version_tag }}.cyclonedx.json.zst
|
|
if-no-files-found: error
|
|
archive: "false"
|