Snarp/zabbix
1
0
Fork 0
Code Issues Pull requests Actions 2 Packages Projects Releases Wiki Activity

Updated Windows workflow

Browse source
This commit is contained in:
Alexey Pustovalov 2026-03-29 14:44:26 +09:00
parent a70897181f
commit 972096d038
4 changed files with 325 additions and 353 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

188
.github/actions/build-image/action.yml vendored Normal file
View file

@ -0,0 +1,188 @@
name: Docker build and optionally push image on Windows
description: Build a Windows Docker image, optionally push it, and output its digest
inputs:
context:
required: true
description: Docker build context path
dockerfile:
required: true
description: Dockerfile path
tags:
required: true
description: Newline-separated image tags
label_revision:
required: true
description: org.opencontainers.image.revision label value
label_created:
required: true
description: org.opencontainers.image.created label value
pull_images:
required: false
default: ""
description: Newline-separated image references to pull before build
build_args:
required: false
default: ""
description: Newline-separated build arguments in NAME=value format
push:
required: false
default: "true"
description: Whether to push built image tags
remove_readme:
required: false
default: "true"
description: Whether to remove README.md from the build context
outputs:
digest:
description: Built image digest or image ID
value: ${{ steps.build_push.outputs.digest }}
runs:
using: composite
steps:
- name: Build and optionally push image
id: build_push
shell: pwsh
env:
CONTEXT: ${{ inputs.context }}
DOCKERFILE: ${{ inputs.dockerfile }}
TAGS: ${{ inputs.tags }}
LABEL_REVISION: ${{ inputs.label_revision }}
LABEL_CREATED: ${{ inputs.label_created }}
PULL_IMAGES: ${{ inputs.pull_images }}
BUILD_ARGS_INPUT: ${{ inputs.build_args }}
PUSH_IMAGES: ${{ inputs.push }}
REMOVE_README: ${{ inputs.remove_readme }}
run: |
$ErrorActionPreference = 'Stop'
Set-StrictMode -Version Latest
Write-Output '::group::Docker version'
docker version
Write-Output '::endgroup::'
Write-Output '::group::Docker info'
docker info
Write-Output '::endgroup::'
if ($Env:REMOVE_README -eq 'true') {
Remove-Item -ErrorAction Ignore -Force -Path (Join-Path $Env:CONTEXT 'README.md')
}
$tagsArray = $Env:TAGS -split "\r?\n" | Where-Object { $_.Trim() }
if ($tagsArray.Count -eq 0) {
throw 'No image tags provided'
}
$tagArgs = @()
foreach ($tag in $tagsArray) {
$tagArgs += "--tag=$tag"
}
Write-Output '::group::Image tags'
$tagsArray | ForEach-Object { Write-Output $_ }
Write-Output '::endgroup::'
$pullImagesArray = $Env:PULL_IMAGES -split "\r?\n" | Where-Object { $_.Trim() }
if ($pullImagesArray.Count -gt 0) {
Write-Output '::group::Pull base images'
foreach ($image in $pullImagesArray) {
Write-Output "docker pull $image"
docker pull $image
if (-not $?) {
throw "Failed to pull $image"
}
}
Write-Output '::endgroup::'
}
$buildArgsInputArray = $Env:BUILD_ARGS_INPUT -split "\r?\n" | Where-Object { $_.Trim() }
$buildArgCliArgs = @()
foreach ($buildArg in $buildArgsInputArray) {
$buildArgCliArgs += "--build-arg=$buildArg"
}
Write-Output '::group::Build arguments'
if ($buildArgsInputArray.Count -gt 0) {
$buildArgsInputArray | ForEach-Object { Write-Output $_ }
}
else {
Write-Output 'No build arguments provided'
}
Write-Output '::endgroup::'
Write-Output '::group::Build image'
Write-Output @"
docker build --label org.opencontainers.image.revision=$Env:LABEL_REVISION `
--label org.opencontainers.image.created=$Env:LABEL_CREATED `
$($buildArgCliArgs -join " ") `
--file=$Env:DOCKERFILE `
$($tagArgs -join " ") `
$Env:CONTEXT
"@
docker build `
--label "org.opencontainers.image.revision=$Env:LABEL_REVISION" `
--label "org.opencontainers.image.created=$Env:LABEL_CREATED" `
$buildArgCliArgs `
--file "$Env:DOCKERFILE" `
$tagArgs `
"$Env:CONTEXT"
if (-not $?) {
throw 'Failed to build image'
}
Write-Output '::endgroup::'
Write-Output '::group::Publish image'
if ($Env:PUSH_IMAGES -eq 'true') {
foreach ($tag in $tagsArray) {
Write-Output "docker image push $tag"
docker image push $tag
if (-not $?) {
throw "Failed to push $tag"
}
}
$repoDigest = docker inspect $tagsArray[0] --format "{{ index .RepoDigests 0}}"
if (-not $?) {
throw "Failed to inspect RepoDigests for $($tagsArray[0])"
}
$digest = $repoDigest.Split('@')[-1]
if ([string]::IsNullOrWhiteSpace($digest)) {
throw 'Image digest is empty'
}
Write-Output 'Image digest got from RepoDigests'
}
else {
$digest = docker inspect $tagsArray[0] --format "{{ .Id }}"
if (-not $?) {
throw "Failed to inspect image Id for $($tagsArray[0])"
}
if ([string]::IsNullOrWhiteSpace($digest)) {
throw 'Image ID digest is empty'
}
Write-Output 'Image digest got from Id'
}
Write-Output '::endgroup::'
Write-Output '::group::Digest'
Write-Output $digest
Write-Output '::endgroup::'
"digest=$digest" >> $Env:GITHUB_OUTPUT

45
.github/actions/cosign-sign/action.yml vendored
View file

@ -7,12 +7,13 @@ inputs:
description: Built image digest
tags:
required: true
description: Space-separated image tags
description: Newline-separated image tags
runs:
using: composite
steps:
- name: Sign images
- name: Sign images on Linux
if: runner.os != 'Windows'
shell: bash
env:
DIGEST: ${{ inputs.digest }}
@ -21,9 +22,16 @@ runs:
set -euo pipefail
images=()
for tag in ${TAGS}; do
while IFS= read -r tag; do
[[ -n "$tag" ]] || continue
images+=("${tag}@${DIGEST}")
done
done <<< "$TAGS"
if [[ ${#images[@]} -eq 0 ]]; then
echo "No image tags provided"
exit 1
fi
echo "::group::Images to sign"
printf '%s\n' "${images[@]}"
@ -32,3 +40,32 @@ runs:
echo "::group::Signing"
cosign sign --yes "${images[@]}"
echo "::endgroup::"
- name: Sign images on Windows
if: runner.os == 'Windows'
shell: pwsh
env:
DIGEST: ${{ inputs.digest }}
TAGS: ${{ inputs.tags }}
run: |
$ErrorActionPreference = 'Stop'
Set-StrictMode -Version Latest
$images = @()
$tagsArray = $Env:TAGS -split "\r?\n" | Where-Object { $_.Trim() }
foreach ($tag in $tagsArray) {
$images += "$tag@$Env:DIGEST"
}
if ($images.Count -eq 0) {
throw 'No image tags provided'
}
Write-Output '::group::Images to sign'
$images | ForEach-Object { Write-Output $_ }
Write-Output '::endgroup::'
Write-Output '::group::Signing'
cosign sign --yes $images
Write-Output '::endgroup::'

27
.github/actions/cosign-verify/action.yml vendored
View file

@ -15,7 +15,8 @@ inputs:
runs:
using: composite
steps:
- name: Verify image signature
- name: Verify image signature on Linux
if: runner.os != 'Windows'
shell: bash
env:
IMAGE: ${{ inputs.image }}
@ -36,3 +37,27 @@ runs:
--certificate-identity-regexp "$IDENTITY_REGEX" \
"$IMAGE" | jq
echo "::endgroup::"
- name: Verify image signature on Windows
if: runner.os != 'Windows'
shell: pwsh
env:
IMAGE: ${{ inputs.image }}
OIDC_ISSUER: ${{ inputs.oidc_issuer }}
IDENTITY_REGEX: ${{ inputs.identity_regexp }}
run: |
$ErrorActionPreference = 'Stop'
Set-StrictMode -Version Latest
Write-Output '::group::Image sign data'
Write-Output "OIDC issuer=$env:OIDC_ISSUER"
Write-Output "Identity=$env:IDENTITY_REGEX"
Write-Output "Image to verify=$env:IMAGE"
Write-Output '::endgroup::'
Write-Output '::group::Verify signature'
cosign verify `
--certificate-oidc-issuer-regexp "$env:OIDC_ISSUER" `
--certificate-identity-regexp "$env:IDENTITY_REGEX" `
"$env:IMAGE" | ConvertFrom-Json | ConvertTo-Json -Depth 100
Write-Output '::endgroup::'

418
.github/workflows/images_build_windows.yml vendored
View file

@ -221,112 +221,30 @@ jobs:
- name: Build and push image
id: docker_build
env:
DOCKERFILES_DIRECTORY: ${{ env.DOCKERFILES_DIRECTORY }}
BASE_BUILD_IMAGE: ${{ env.MSFT_BASE_BUILD_IMAGE }}
BASE_IMAGE_NAME: ${{ env.BASE_IMAGE_NAME }}
MATRIX_COMPONENT: ${{ matrix.component }}
TAGS: ${{ steps.meta.outputs.tags }}
BASE_OS_TAG: ${{ steps.base_os_tag.outputs.os_tag }}
LABEL_REVISION: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
LABEL_CREATED: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
run: |
echo "::group::Docker version"
docker version
echo "::endgroup::"
echo "::group::Docker info"
docker info
echo "::endgroup::"
$context = "$Env:DOCKERFILES_DIRECTORY\$Env:BASE_IMAGE_NAME\windows\"
$dockerfile = "$context" + "Dockerfile." + "$Env:MATRIX_COMPONENT"
$baseOsImage = "$Env:BASE_BUILD_IMAGE" + ":" + "$Env:BASE_OS_TAG"
Remove-Item -ErrorAction Ignore -Force -Path "$context\README.md"
$tagsArray = $Env:TAGS.Split("`n", [System.StringSplitOptions]::RemoveEmptyEntries)
$tagArgs = $tagsArray | ForEach-Object { "--tag=$_" }
echo "::group::Image tags"
echo "$Env:TAGS"
echo "::endgroup::"
echo "::group::Pull base image"
docker pull $baseOsImage
if (-not $?) { throw "Failed to pull $baseOsImage" }
echo "::endgroup::"
echo "::group::Build Image"
Write-Host @"
docker build --label org.opencontainers.image.revision=$Env:LABEL_REVISION
--label org.opencontainers.image.created=$Env:LABEL_CREATED
--build-arg=OS_BASE_IMAGE=$baseOsImage
--file=$dockerfile
$tagArgs
$context
"@
docker build --label org.opencontainers.image.revision=$Env:LABEL_REVISION `
--label org.opencontainers.image.created=$Env:LABEL_CREATED `
--build-arg=OS_BASE_IMAGE=$baseOsImage `
--file=$dockerfile `
$tagArgs `
$context
if (-not $?) { throw "Failed to build image" }
echo "::endgroup::"
echo "::group::Publish Image"
foreach ($tag in $tagsArray) {
echo "docker image push $tag"
docker image push $tag
if (-not $?) { throw "Failed to push $tag" }
}
$repoDigest = docker inspect $tagsArray[0] --format "{{ index .RepoDigests 0}}"
if (-not $?) { throw "Failed to inspect RepoDigests for $($tagsArray[0])" }
$digest = $repoDigest.Split('@')[-1]
if ([string]::IsNullOrWhiteSpace($digest)) {
throw "Image digest is empty"
}
echo "Image digest got from RepoDigests"
echo "::endgroup::"
echo "::group::Digest"
echo "$digest"
echo "::endgroup::"
echo "digest=$digest" >> $Env:GITHUB_OUTPUT
uses: ./.github/actions/docker-build-push-windows
with:
context: ${{ env.DOCKERFILES_DIRECTORY }}\${{ env.BASE_IMAGE_NAME }}\windows
dockerfile: ${{ env.DOCKERFILES_DIRECTORY }}\${{ env.BASE_IMAGE_NAME }}\windows\Dockerfile.${{ matrix.component }}
tags: ${{ steps.meta.outputs.tags }}
label_revision: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
label_created: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
pull_images: |
${{ env.MSFT_BASE_BUILD_IMAGE }}:${{ steps.base_os_tag.outputs.os_tag }}
build_args: |
OS_BASE_IMAGE=${{ env.MSFT_BASE_BUILD_IMAGE }}:${{ steps.base_os_tag.outputs.os_tag }}
push: true
- name: Sign the images with GitHub OIDC Token
env:
DIGEST: ${{ steps.docker_build.outputs.digest }}
TAGS: ${{ steps.meta.outputs.tags }}
run: |
$tagsArray = $Env:TAGS.Split("`n", [System.StringSplitOptions]::RemoveEmptyEntries)
$tagList = @()
foreach ($tag in $tagsArray) {
$tagName = $tag.Split(":")[0]
$tagList += "$tagName@$Env:DIGEST"
}
echo "::group::Images to sign"
echo "$tagList"
echo "::endgroup::"
echo "::group::Signing"
echo "cosign sign --yes $tagList"
cosign sign --yes $tagList
echo "::endgroup::"
uses: ./.github/actions/cosign-sign
with:
digest: ${{ steps.docker_build.outputs.digest }}
tags: ${{ steps.meta.outputs.tags }}
- name: Attest images
uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
uses: ./.github/actions/attest-image
with:
subject-name: ${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, env.BASE_IMAGE_NAME ) }}
subject-digest: ${{ steps.docker_build.outputs.digest }}
push-to-registry: true
subject_name: ${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, env.BASE_IMAGE_NAME ) }}
subject_digest: ${{ steps.docker_build.outputs.digest }}
- name: Image digest
env:
@ -458,125 +376,38 @@ jobs:
echo "base_build_image=$buildBaseImage" >> $Env:GITHUB_OUTPUT
- name: Verify ${{ env.BASE_IMAGE_NAME }}:${{ matrix.os }} cosign
env:
BASE_IMAGE: ${{ steps.base_build.outputs.base_build_image }}
OIDC_ISSUER: ${{ env.OIDC_ISSUER }}
IDENTITY_REGEX: ${{ env.IDENTITY_REGEX }}
run: |
cosign verify `
--certificate-oidc-issuer-regexp "$Env:OIDC_ISSUER" `
--certificate-identity-regexp "$Env:IDENTITY_REGEX" `
"$Env:BASE_IMAGE" | jq
uses: ./.github/actions/cosign-verify
with:
image: ${{ steps.base_build.outputs.base_build_image }}
oidc_issuer: ${{ env.OIDC_ISSUER }}
identity_regexp: ${{ env.IDENTITY_REGEX }}
- name: Build and push image
id: docker_build
env:
DOCKERFILES_DIRECTORY: ${{ env.DOCKERFILES_DIRECTORY }}
BASE_BUILD_IMAGE: ${{ steps.base_build.outputs.base_build_image }}
BASE_BUILD_IMAGE_NAME: ${{ env.BASE_BUILD_IMAGE_NAME }}
BASE_BUILD_OS_TAG: ${{ steps.base_os_tag.outputs.os_tag }}
MATRIX_COMPONENT: ${{ matrix.component }}
TAGS: ${{ steps.meta.outputs.tags }}
LABEL_REVISION: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
LABEL_CREATED: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
run: |
echo "::group::Docker version"
docker version
echo "::endgroup::"
echo "::group::Docker info"
docker info
echo "::endgroup::"
$context = "$Env:DOCKERFILES_DIRECTORY\$Env:BASE_BUILD_IMAGE_NAME\windows\"
$dockerfile = "$context" + "Dockerfile." + "$Env:MATRIX_COMPONENT"
$baseBuildImage = $Env:BASE_BUILD_IMAGE
Remove-Item -ErrorAction Ignore -Force -Path "$context\README.md"
$tagsArray = $Env:TAGS.Split("`n", [System.StringSplitOptions]::RemoveEmptyEntries)
$tagArgs = $tagsArray | ForEach-Object { "--tag=$_" }
echo "::group::Image tags"
echo "$Env:TAGS"
echo "::endgroup::"
echo "::group::Pull base image"
docker pull $baseBuildImage
if (-not $?) { throw "Failed to pull $baseBuildImage" }
echo "::endgroup::"
echo "::group::Build Image"
Write-Host @"
docker build --label org.opencontainers.image.revision=$Env:LABEL_REVISION
--label org.opencontainers.image.created=$Env:LABEL_CREATED
--build-arg=BUILD_BASE_IMAGE=$baseBuildImage
--file=$dockerfile
$tagArgs
$context
"@
docker build --label org.opencontainers.image.revision=$Env:LABEL_REVISION `
--label org.opencontainers.image.created=$Env:LABEL_CREATED `
--build-arg=BUILD_BASE_IMAGE=$baseBuildImage `
--file=$dockerfile `
$tagArgs `
$context
if (-not $?) { throw "Failed to build image" }
echo "::endgroup::"
echo "::group::Publish Image"
foreach ($tag in $tagsArray) {
echo "docker image push $tag"
docker image push $tag
if (-not $?) { throw "Failed to push $tag" }
}
$repoDigest = docker inspect $tagsArray[0] --format "{{ index .RepoDigests 0}}"
if (-not $?) { throw "Failed to inspect RepoDigests for $($tagsArray[0])" }
$digest = $repoDigest.Split('@')[-1]
if ([string]::IsNullOrWhiteSpace($digest)) {
throw "Image digest is empty"
}
echo "Image digest got from RepoDigests"
echo "::endgroup::"
echo "::group::Digest"
echo "$digest"
echo "::endgroup::"
echo "digest=$digest" >> $Env:GITHUB_OUTPUT
uses: ./.github/actions/docker-build-push-windows
with:
context: ${{ env.DOCKERFILES_DIRECTORY }}\${{ env.BASE_BUILD_IMAGE_NAME }}\windows
dockerfile: ${{ env.DOCKERFILES_DIRECTORY }}\${{ env.BASE_BUILD_IMAGE_NAME }}\windows\Dockerfile.${{ matrix.component }}
tags: ${{ steps.meta.outputs.tags }}
label_revision: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
label_created: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
pull_images: |
${{ steps.base_build.outputs.base_build_image }}
build_args: |
BUILD_BASE_IMAGE=${{ steps.base_build.outputs.base_build_image }}
push: true
- name: Attest images
uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
uses: ./.github/actions/attest-image
with:
subject-name: ${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, env.BASE_BUILD_IMAGE_NAME ) }}
subject-digest: ${{ steps.docker_build.outputs.digest }}
push-to-registry: true
subject_name: ${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, env.BASE_BUILD_IMAGE_NAME ) }}
subject_digest: ${{ steps.docker_build.outputs.digest }}
- name: Sign the images with GitHub OIDC Token
env:
DIGEST: ${{ steps.docker_build.outputs.digest }}
TAGS: ${{ steps.meta.outputs.tags }}
run: |
$tagsArray = $Env:TAGS.Split("`n", [System.StringSplitOptions]::RemoveEmptyEntries)
$tagList = @()
foreach ($tag in $tagsArray) {
$tagName = $tag.Split(":")[0]
$tagList += "$tagName@$Env:DIGEST"
}
echo "::group::Images to sign"
echo "$tagList"
echo "::endgroup::"
echo "::group::Signing"
echo "cosign sign --yes $tagList"
cosign sign --yes $tagList
echo "::endgroup::"
uses: ./.github/actions/cosign-sign
with:
digest: ${{ steps.docker_build.outputs.digest }}
tags: ${{ steps.meta.outputs.tags }}
- name: Image digest
env:
@ -710,150 +541,41 @@ jobs:
echo "base_build_image=$buildBaseImage" >> $Env:GITHUB_OUTPUT
- name: Verify ${{ env.BASE_BUILD_IMAGE_NAME }}:${{ matrix.os }} cosign
env:
BASE_IMAGE: ${{ steps.base_build.outputs.base_build_image }}
OIDC_ISSUER: ${{ env.OIDC_ISSUER }}
IDENTITY_REGEX: ${{ env.IDENTITY_REGEX }}
run: |
cosign verify `
--certificate-oidc-issuer-regexp "$Env:OIDC_ISSUER" `
--certificate-identity-regexp "$Env:IDENTITY_REGEX" `
"$Env:BASE_IMAGE" | jq
uses: ./.github/actions/cosign-verify
with:
image: ${{ steps.base_build.outputs.base_build_image }}
oidc_issuer: ${{ env.OIDC_ISSUER }}
identity_regexp: ${{ env.IDENTITY_REGEX }}
- name: Build and optionally push image
- name: Build and push image
id: docker_build
env:
DOCKERFILES_DIRECTORY: ${{ env.DOCKERFILES_DIRECTORY }}
BASE_BUILD_IMAGE: ${{ steps.base_build.outputs.base_build_image }}
BASE_BUILD_IMAGE_NAME: ${{ env.BASE_BUILD_IMAGE_NAME }}
MATRIX_COMPONENT: ${{ matrix.component }}
TAGS: ${{ steps.meta.outputs.tags }}
BASE_BUILD_OS_TAG: ${{ steps.base_os_tag.outputs.os_tag }}
LABEL_REVISION: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
LABEL_CREATED: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
OS_BASE_IMAGE_NAME: ${{ env.OS_BASE_IMAGE_NAME }}
AUTO_PUSH_IMAGES: ${{ env.AUTO_PUSH_IMAGES }}
run: |
echo "::group::Docker version"
docker version
echo "::endgroup::"
echo "::group::Docker info"
docker info
echo "::endgroup::"
$context = "$Env:DOCKERFILES_DIRECTORY\$Env:MATRIX_COMPONENT\windows\"
$dockerfile = "$context" + "Dockerfile"
$baseBuildImage = $Env:BASE_BUILD_IMAGE
Remove-Item -ErrorAction Ignore -Force -Path "$context\README.md"
$tagsArray = $Env:TAGS.Split("`n", [System.StringSplitOptions]::RemoveEmptyEntries)
$tagArgs = $tagsArray | ForEach-Object { "--tag=$_" }
$osTagSuffix = $Env:BASE_BUILD_OS_TAG
$baseImage = "$Env:OS_BASE_IMAGE_NAME" + ":" + $osTagSuffix
echo "::group::Image tags"
echo "$Env:TAGS"
echo "::endgroup::"
echo "::group::Pull build base image"
docker pull $baseBuildImage
if (-not $?) { throw "Failed to pull $baseBuildImage" }
echo "::endgroup::"
echo "::group::Pull PowerShell base image"
docker pull $baseImage
if (-not $?) { throw "Failed to pull $baseImage" }
echo "::endgroup::"
echo "::group::Build Image"
Write-Host @"
docker build --label org.opencontainers.image.revision=$Env:LABEL_REVISION
--label org.opencontainers.image.created=$Env:LABEL_CREATED
--build-arg=BUILD_BASE_IMAGE=$baseBuildImage
--build-arg=OS_BASE_IMAGE=$baseImage
--file=$dockerfile
$tagArgs
$context
"@
docker build --label org.opencontainers.image.revision=$Env:LABEL_REVISION `
--label org.opencontainers.image.created=$Env:LABEL_CREATED `
--build-arg=BUILD_BASE_IMAGE=$baseBuildImage `
--build-arg=OS_BASE_IMAGE=$baseImage `
--file=$dockerfile `
$tagArgs `
$context
if (-not $?) { throw "Failed to build image" }
echo "::endgroup::"
echo "::group::Publish Image"
if ($Env:AUTO_PUSH_IMAGES -eq 'true') {
foreach ($tag in $tagsArray) {
echo "docker image push $tag"
docker image push $tag
if (-not $?) { throw "Failed to push $tag" }
}
$repoDigest = docker inspect $tagsArray[0] --format "{{ index .RepoDigests 0}}"
if (-not $?) { throw "Failed to inspect RepoDigests for $($tagsArray[0])" }
$digest = $repoDigest.Split('@')[-1]
if ([string]::IsNullOrWhiteSpace($digest)) {
throw "Image digest is empty"
}
echo "Image digest got from RepoDigests"
}
else {
$digest = docker inspect $tagsArray[0] --format "{{ index .Id}}"
if (-not $?) { throw "Failed to inspect image Id for $($tagsArray[0])" }
if ([string]::IsNullOrWhiteSpace($digest)) {
throw "Image ID digest is empty"
}
echo "Image digest got from Id"
}
echo "::endgroup::"
echo "::group::Digest"
echo "$digest"
echo "::endgroup::"
echo "digest=$digest" >> $Env:GITHUB_OUTPUT
uses: ./.github/actions/docker-build-push-windows
with:
context: ${{ env.DOCKERFILES_DIRECTORY }}\${{ matrix.component }}\windows
dockerfile: ${{ env.DOCKERFILES_DIRECTORY }}\${{ matrix.component }}\windows\Dockerfile
tags: ${{ steps.meta.outputs.tags }}
label_revision: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
label_created: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
pull_images: |
${{ steps.base_build.outputs.base_build_image }}
${{ env.OS_BASE_IMAGE_NAME }}:${{ steps.base_os_tag.outputs.os_tag }}
build_args: |
BUILD_BASE_IMAGE=${{ steps.base_build.outputs.base_build_image }}
OS_BASE_IMAGE=${{ env.OS_BASE_IMAGE_NAME }}:${{ steps.base_os_tag.outputs.os_tag }}
push: ${{ env.AUTO_PUSH_IMAGES }}
- name: Sign the images with GitHub OIDC Token
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
env:
DIGEST: ${{ steps.docker_build.outputs.digest }}
TAGS: ${{ steps.meta.outputs.tags }}
run: |
$tagsArray = $Env:TAGS.Split("`n", [System.StringSplitOptions]::RemoveEmptyEntries)
$tagList = @()
foreach ($tag in $tagsArray) {
$tagName = $tag.Split(":")[0]
$tagList += "$tagName@$Env:DIGEST"
}
echo "::group::Images to sign"
echo "$tagList"
echo "::endgroup::"
echo "::group::Signing"
echo "cosign sign --yes $tagList"
cosign sign --yes $tagList
echo "::endgroup::"
uses: ./.github/actions/cosign-sign
with:
digest: ${{ steps.docker_build.outputs.digest }}
tags: ${{ steps.meta.outputs.tags }}
- name: Attest images
uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
uses: ./.github/actions/attest-image
with:
subject-name: ${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, matrix.component ) }}
subject-digest: ${{ steps.docker_build.outputs.digest }}
push-to-registry: true
subject_name: ${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, matrix.component ) }}
subject_digest: ${{ steps.docker_build.outputs.digest }}
- name: Print final image digest
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}