From 5947cb03eb16f7d012b1bfd3818ace26744ca9db Mon Sep 17 00:00:00 2001 From: Carsten Hoffmann Date: Mon, 18 Nov 2024 13:51:17 +0100 Subject: [PATCH 1/2] New approach with pushing the images in any case and retagging them once the test is complete. --- .github/workflows/build-and-publish.yml | 65 +++++++++++++++---------- 1 file changed, 40 insertions(+), 25 deletions(-) diff --git a/.github/workflows/build-and-publish.yml b/.github/workflows/build-and-publish.yml index 37f7a28..6d694a2 100644 --- a/.github/workflows/build-and-publish.yml +++ b/.github/workflows/build-and-publish.yml @@ -1,10 +1,5 @@ name: Docker -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - on: schedule: - cron: '18 2 * * *' @@ -17,7 +12,6 @@ env: REGISTRY: ghcr.io IMAGE_NAME: dbsystel/postgresql-partman - jobs: build: strategy: @@ -40,8 +34,6 @@ jobs: permissions: contents: read packages: write - # This is used to complete the identity challenge - # with sigstore/fulcio when running outside of PRs. id-token: write steps: @@ -49,17 +41,14 @@ jobs: uses: actions/checkout@v4 # Install the cosign tool except on PR - # https://github.com/sigstore/cosign-installer - name: Install cosign if: github.event_name != 'pull_request' uses: sigstore/cosign-installer@v3.4.0 - # Workaround: https://github.com/docker/build-push-action/issues/461 - name: Setup Docker buildx uses: docker/setup-buildx-action@v3 # Login against a Docker registry except on PR - # https://github.com/docker/login-action - name: Log into registry ${{ env.REGISTRY }} if: github.event_name != 'pull_request' uses: docker/login-action@v3 @@ -69,7 +58,6 @@ jobs: password: ${{ secrets.GITHUB_TOKEN }} # Extract metadata (tags, labels) for Docker - # https://github.com/docker/metadata-action - name: Extract Docker metadata id: meta uses: docker/metadata-action@v5 @@ -80,8 +68,7 @@ jobs: type=raw,value=${{ matrix.postgres_version }},enable=${{ matrix.default == 'true'}} ${{ matrix.postgres_version }}-${{ matrix.major }} - # Build and push Docker image with Buildx (don't push on PR) - # https://github.com/docker/build-push-action + # Build and push Docker image with Buildx, using only the digest - name: Build and push Docker image id: build-and-push uses: docker/build-push-action@v5 @@ -92,22 +79,50 @@ jobs: PARTMAN_VERSION=${{ matrix.partman_version }} PARTMAN_CHECKSUM=${{ matrix.partman_checksum }} platforms: linux/amd64,linux/arm64 - push: ${{ github.event_name != 'pull_request' }} - tags: ${{ steps.meta.outputs.tags }} + push: true + tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:pipeline labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max + # Test the built Docker image using the digest + - name: Test Docker image + env: + POSTGRES_PASSWORD: examplepassword + run: | + DIGEST=${{ steps.build-and-push.outputs.digest }} + docker run -d --name test-db -e POSTGRES_PASSWORD=$POSTGRES_PASSWORD ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@$DIGEST + sleep 30 + docker exec test-db pg_isready -U postgres + docker stop test-db + docker rm test-db - # Sign the resulting Docker image digest except on PRs. - # This will only write to the public Rekor transparency log when the Docker - # repository is public to avoid leaking data. If you would like to publish - # transparency data ev en for private images, pass --force to cosign below. - # https://github.com/sigstore/cosign + # Build and push Docker image with Buildx,this time using the final tags + - name: Build and push Docker image + id: build-and-push + if: github.event_name != 'pull_request' + uses: docker/build-push-action@v5 + with: + context: . + build-args: | + POSTGRESQL_VERSION=${{ matrix.postgres_version }} + PARTMAN_VERSION=${{ matrix.partman_version }} + PARTMAN_CHECKSUM=${{ matrix.partman_checksum }} + platforms: linux/amd64,linux/arm64 + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max + + # Sign the resulting Docker image digest except on PRs - name: Sign the published Docker image - if: ${{ github.event_name != 'pull_request' }} + if: github.event_name != 'pull_request' env: COSIGN_EXPERIMENTAL: "true" - # This step uses the identity token to provision an ephemeral certificate - # against the sigstore community Fulcio instance. - run: echo "${{ steps.meta.outputs.tags }}" | xargs -I {} cosign sign -y {}@${{ steps.build-and-push.outputs.digest }} + run: | + DIGEST=${{ steps.build-and-push.outputs.digest }} + TAGS=$(echo ${{ steps.meta.outputs.tags }} | tr ',' '\n') + for TAG in $TAGS; do + cosign sign -y ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:$TAG + done From c96bf30a35524be207d6af2dfa8b87dc77e41f19 Mon Sep 17 00:00:00 2001 From: Carsten Hoffmann Date: Mon, 18 Nov 2024 14:07:23 +0100 Subject: [PATCH 2/2] New approach with pushing the images in any case and retagging them once the test is complete. --- .github/workflows/build-and-publish.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/.github/workflows/build-and-publish.yml b/.github/workflows/build-and-publish.yml index 6d694a2..b8ee64d 100644 --- a/.github/workflows/build-and-publish.yml +++ b/.github/workflows/build-and-publish.yml @@ -50,7 +50,6 @@ jobs: # Login against a Docker registry except on PR - name: Log into registry ${{ env.REGISTRY }} - if: github.event_name != 'pull_request' uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} @@ -69,8 +68,8 @@ jobs: ${{ matrix.postgres_version }}-${{ matrix.major }} # Build and push Docker image with Buildx, using only the digest - - name: Build and push Docker image - id: build-and-push + - name: Build and push Docker image with digest + id: build-and-push-digest uses: docker/build-push-action@v5 with: context: . @@ -90,7 +89,7 @@ jobs: env: POSTGRES_PASSWORD: examplepassword run: | - DIGEST=${{ steps.build-and-push.outputs.digest }} + DIGEST=${{ steps.build-and-push-digest.outputs.digest }} docker run -d --name test-db -e POSTGRES_PASSWORD=$POSTGRES_PASSWORD ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@$DIGEST sleep 30 docker exec test-db pg_isready -U postgres @@ -98,8 +97,8 @@ jobs: docker rm test-db # Build and push Docker image with Buildx,this time using the final tags - - name: Build and push Docker image - id: build-and-push + - name: Build and push Docker image with final tags (release) + id: build-and-push-release if: github.event_name != 'pull_request' uses: docker/build-push-action@v5 with: