Skip to content

build_dev_master_images #480

build_dev_master_images

build_dev_master_images #480

name: build_dev_master_images
on:
schedule:
# Runs every day
- cron: '30 2 * * * '
push:
branches:
- main
env:
REGISTRY_USER: ${{ github.actor }}
REGISTRY_PASSWORD: ${{ github.token }}
IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
jobs:
build_dev_master:
name: ${{ matrix.build.name }}
runs-on: 'ubuntu-latest'
permissions:
contents: read
packages: write
strategy:
fail-fast: false
matrix:
install_latest: [ true ]
steps:
- name: Checkout repository
uses: actions/checkout@v3
with:
ref: "main"
- name: Log in to ghcr.io
uses: redhat-actions/podman-login@v1
with:
username: ${{ env.REGISTRY_USER }}
password: ${{ env.REGISTRY_PASSWORD }}
registry: ${{ env.IMAGE_REGISTRY }}
- name: "login docker hub"
run: |
podman login -u ${{secrets.DOCKER_HUB_USER}} -p ${{secrets.DOCKER_HUB_TOKEN}} docker.io
docker login -u ${{secrets.DOCKER_HUB_USER}} -p ${{secrets.DOCKER_HUB_TOKEN}}
- name: "login quay.io"
run: |
podman login -u ${{secrets.QUAY_USER}} -p ${{secrets.QUAY_TOKEN}} quay.io
docker login -u ${{secrets.QUAY_USER}} -p ${{secrets.QUAY_TOKEN}} quay.io
- run: |
sudo apt-get update
sudo apt-get -y install buildah less git make podman qemu clamav clamav-freshclam
name: 'install dev deps'
- run: buildah unshare make branch_or_ref=master release_tag=master build_debian
name: 'build debian dev image'
- run: make image_name=localhost/curl-dev-debian:master scan
name: 'security scan image'
- run: |
buildah push curl-dev-debian:master "docker://ghcr.io/curl/curl-container/curl-dev-debian:master"
name: 'push images to github registry'
- name: Install Cosign
uses: sigstore/cosign-installer@main
- name: Write signing key to disk (only needed for `cosign sign --key`)
run: echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > cosign.key
- name: Sign image with a key
run: |
cosign sign -y --key cosign.key ghcr.io/curl/curl-container/curl-dev-debian:master
env:
COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
- name: Write public key to disk
run: echo "${{ secrets.COSIGN_PUBLIC_KEY }}" > cosign.pub
- name: Verify image with public key
run: |
cosign verify --key cosign.pub ghcr.io/curl/curl-container/curl-dev-debian:master
- run: buildah unshare make branch_or_ref=master release_tag=master build_fedora
name: 'build fedora dev image'
- run: make image_name=localhost/curl-dev-fedora:master scan
name: 'security scan image'
- run: |
buildah push curl-dev-fedora:master "docker://ghcr.io/curl/curl-container/curl-dev-fedora:master"
name: 'push images to github registry'
- name: Install Cosign
uses: sigstore/cosign-installer@main
- name: Write signing key to disk (only needed for `cosign sign --key`)
run: echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > cosign.key
- name: Sign image with a key
run: |
cosign sign -y --key cosign.key ghcr.io/curl/curl-container/curl-dev-fedora:master
env:
COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
- name: Write public key to disk
run: echo "${{ secrets.COSIGN_PUBLIC_KEY }}" > cosign.pub
- name: Verify image with public key
run: |
cosign verify --key cosign.pub ghcr.io/curl/curl-container/curl-dev-fedora:master