734 lines
29 KiB
YAML
734 lines
29 KiB
YAML
name: Build images (DockerHub, Windows)
|
|
|
|
on:
|
|
release:
|
|
types:
|
|
- published
|
|
push:
|
|
branches:
|
|
- '[0-9]+.[0-9]+'
|
|
- 'trunk'
|
|
paths:
|
|
- 'build.json'
|
|
- 'Dockerfiles/*/windows/*'
|
|
- 'templates/config/*_windows/**'
|
|
- 'templates/entrypoints/**/*.go'
|
|
- 'templates/entrypoints/go.mod'
|
|
- 'templates/entrypoints/licenses/go-THIRD-PARTY-NOTICES.txt'
|
|
- '!**/README.md'
|
|
- '.github/workflows/images_build_windows.yml'
|
|
- '.github/actions/docker-build-push-windows/*'
|
|
schedule:
|
|
- cron: '05 02 * * *'
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: windows-build-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
defaults:
|
|
run:
|
|
shell: pwsh
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
TRUNK_ONLY_EVENT: ${{ contains(fromJSON('["schedule"]'), github.event_name) }}
|
|
AUTO_PUSH_IMAGES: ${{ vars.AUTO_PUSH_IMAGES }}
|
|
|
|
DOCKER_REGISTRY: ${{ vars.DOCKER_REGISTRY }}
|
|
DOCKER_REPOSITORY: ${{ vars.DOCKER_REPOSITORY }}
|
|
TRUNK_GIT_BRANCH: "refs/heads/trunk"
|
|
IMAGES_PREFIX: "zabbix-"
|
|
|
|
MSFT_BASE_BUILD_IMAGE: "mcr.microsoft.com/windows/servercore"
|
|
OS_BASE_IMAGE_NAME: "mcr.microsoft.com/windows/nanoserver"
|
|
ENTRYPOINT_BUILD_IMAGE_NAME: "golang:1.26.5-windowsservercore"
|
|
|
|
BASE_IMAGE_NAME: "build-base"
|
|
BASE_BUILD_IMAGE_NAME: "build-mysql"
|
|
|
|
MATRIX_FILE: "build.json"
|
|
DOCKERFILES_DIRECTORY: "Dockerfiles"
|
|
|
|
OIDC_ISSUER: "https://token.actions.githubusercontent.com"
|
|
IDENTITY_REGEX: "${{ github.server_url }}/${{ github.repository }}/.github/"
|
|
|
|
jobs:
|
|
init_build:
|
|
name: Initialize build
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
outputs:
|
|
os: ${{ steps.os.outputs.list }}
|
|
components: ${{ steps.components.outputs.list }}
|
|
is_default_branch: ${{ steps.branch_info.outputs.is_default_branch }}
|
|
current_branch: ${{ steps.branch_info.outputs.current_branch }}
|
|
sha_short: ${{ steps.branch_info.outputs.sha_short }}
|
|
steps:
|
|
- name: Block egress traffic
|
|
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
|
|
with:
|
|
disable-sudo: true
|
|
egress-policy: block
|
|
disable-telemetry: true
|
|
allowed-endpoints: >
|
|
github.com:443
|
|
release-assets.githubusercontent.com:443
|
|
|
|
- name: Checkout repository
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
ref: ${{ env.TRUNK_ONLY_EVENT == 'true' && env.TRUNK_GIT_BRANCH || '' }}
|
|
fetch-depth: 1
|
|
sparse-checkout: |
|
|
${{ env.MATRIX_FILE }}
|
|
.github
|
|
|
|
- name: Check matrix file
|
|
env:
|
|
MATRIX_FILE: ${{ env.MATRIX_FILE }}
|
|
run: |
|
|
if [[ ! -f "$MATRIX_FILE" ]]; then
|
|
echo "::error::File $MATRIX_FILE is missing"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Prepare Operating System list
|
|
id: os
|
|
env:
|
|
MATRIX_FILE: ${{ env.MATRIX_FILE }}
|
|
run: |
|
|
os_list="$(jq -c '.["os-windows"] | keys' "$MATRIX_FILE")"
|
|
|
|
echo "::group::Operating System List"
|
|
echo "$os_list"
|
|
echo "::endgroup::"
|
|
|
|
echo "list=$os_list" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Prepare Zabbix component list
|
|
id: components
|
|
shell: bash
|
|
run: |
|
|
component_list='["agent","agent2"]'
|
|
|
|
echo "::group::Zabbix Component List"
|
|
echo "$component_list"
|
|
echo "::endgroup::"
|
|
|
|
echo "list=$component_list" >> $GITHUB_OUTPUT
|
|
|
|
- name: Get branch info
|
|
id: branch_info
|
|
uses: ./.github/actions/get-branch-info
|
|
with:
|
|
trunk_version: ${{ inputs.trunk_version }}
|
|
trunk_git_branch: ${{ env.TRUNK_GIT_BRANCH }}
|
|
|
|
build_base:
|
|
name: Build ${{ matrix.component }} base on ${{ matrix.os }}
|
|
needs: init_build
|
|
runs-on: ${{ matrix.os }}
|
|
timeout-minutes: 70
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
attestations: write
|
|
artifact-metadata: write
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os: ${{ fromJson(needs.init_build.outputs.os) }}
|
|
component: ${{ fromJson(needs.init_build.outputs.components) }}
|
|
|
|
steps:
|
|
- name: Block egress traffic
|
|
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
|
|
with:
|
|
disable-sudo: true
|
|
egress-policy: block
|
|
disable-telemetry: true
|
|
allowed-endpoints: >
|
|
aka.ms:443
|
|
api.github.com:443
|
|
auth.docker.io:443
|
|
curl.se:443
|
|
dc.services.visualstudio.com:443
|
|
definitionupdates.microsoft.com:443
|
|
dl.google.com:443
|
|
download.visualstudio.microsoft.com:443
|
|
fulcio.sigstore.dev:443
|
|
github.com:443
|
|
go.dev:443
|
|
go.microsoft.com:443
|
|
index.docker.io:443
|
|
mcr.microsoft.com:443
|
|
mobile.events.data.microsoft.com:443
|
|
ocsp.digicert.com:80
|
|
ocsp.sectigo.com:80
|
|
production.cloudflare.docker.com:443
|
|
r12.c.lencr.org:80
|
|
raw.githubusercontent.com:443
|
|
registry-1.docker.io:443
|
|
rekor.sigstore.dev:443
|
|
tuf-repo-cdn.sigstore.dev:443
|
|
www.nasm.us:443
|
|
x1.c.lencr.org:80
|
|
zlib.net:443
|
|
|
|
- name: Checkout repository
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
ref: ${{ env.TRUNK_ONLY_EVENT == 'true' && env.TRUNK_GIT_BRANCH || '' }}
|
|
fetch-depth: 1
|
|
|
|
- name: Install cosign
|
|
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
|
|
uses: ./.github/actions/cosign-install
|
|
|
|
- name: Base Windows OS tag
|
|
id: base_os_tag
|
|
env:
|
|
MATRIX_OS: ${{ matrix.os }}
|
|
MATRIX_FILE: ${{ env.MATRIX_FILE }}
|
|
run: |
|
|
$matrixFile = "$env:MATRIX_FILE"
|
|
$matrixOs = "$env:MATRIX_OS"
|
|
|
|
$osTag = (Get-Content -Path $matrixFile | ConvertFrom-Json).'os-windows'."$matrixOs"
|
|
|
|
if ([string]::IsNullOrWhiteSpace($osTag)) {
|
|
throw "Failed to detect Windows base OS tag for '$matrixOs'"
|
|
}
|
|
|
|
echo "::group::Base Microsoft Windows OS tag"
|
|
echo "$osTag"
|
|
echo "::endgroup::"
|
|
|
|
Add-Content -Path $env:GITHUB_OUTPUT -Value "os_tag=$osTag"
|
|
|
|
- name: Generate toolchain tag
|
|
id: toolchain_tag
|
|
env:
|
|
COMPONENT: ${{ matrix.component }}
|
|
OS_TAG: ${{ steps.base_os_tag.outputs.os_tag }}
|
|
IMAGE: ${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, env.BASE_IMAGE_NAME ) }}
|
|
CONTEXT: ${{ format('{0}/{1}/windows', env.DOCKERFILES_DIRECTORY, env.BASE_IMAGE_NAME) }}
|
|
CURRENT_BRANCH: ${{ needs.init_build.outputs.current_branch }}
|
|
OS_BASE_IMAGE: ${{ env.MSFT_BASE_BUILD_IMAGE }}
|
|
run: |
|
|
$component = "$env:COMPONENT"
|
|
$osTag = "$env:OS_TAG"
|
|
$epoch = Get-Date -Format 'yyyyMM'
|
|
$context = "$env:CONTEXT"
|
|
$branch = "$env:CURRENT_BRANCH"
|
|
$baseImage = "$env:IMAGE"
|
|
$osBaseImage = "$env:OS_BASE_IMAGE"
|
|
$branch = ($branch -replace '[^A-Za-z0-9_.-]', '-').Trim('.-')
|
|
|
|
if ([string]::IsNullOrWhiteSpace($branch)) {
|
|
throw 'Current branch is empty after Docker tag normalization'
|
|
}
|
|
|
|
$files = @(
|
|
"$context/Dockerfile.$component"
|
|
)
|
|
|
|
if ($component -eq 'agent') {
|
|
$files += "$context/CMakeLists.txt"
|
|
}
|
|
|
|
$inputText = @()
|
|
foreach ($file in $files) {
|
|
$inputText += "### $file"
|
|
$inputText += Get-Content -Raw -Path $file
|
|
}
|
|
|
|
$inputText += "OS_BASE_IMAGE=${osBaseImage}:$osTag"
|
|
$inputText += "TOOLCHAIN_EPOCH=$epoch"
|
|
|
|
$bytes = [System.Text.Encoding]::UTF8.GetBytes(($inputText -join "`n"))
|
|
$sha256 = [System.Security.Cryptography.SHA256]::Create()
|
|
try {
|
|
$hashBytes = $sha256.ComputeHash($bytes)
|
|
}
|
|
finally {
|
|
$sha256.Dispose()
|
|
}
|
|
|
|
$hash = -join ($hashBytes | ForEach-Object { $_.ToString("x2") })
|
|
$shortHash = $hash.Substring(0, 12)
|
|
|
|
$tag = "$component-$osTag-$branch-$epoch-$shortHash"
|
|
$ref = "${baseImage}:${tag}"
|
|
|
|
echo "::group::Base Microsoft Windows OS ref"
|
|
echo "Ref - $ref"
|
|
echo "::endgroup::"
|
|
|
|
Add-Content -Path $env:GITHUB_OUTPUT -Value "tag=$tag"
|
|
Add-Content -Path $env:GITHUB_OUTPUT -Value "ref=$ref"
|
|
|
|
- name: Verify toolchain
|
|
id: toolchain_lookup
|
|
env:
|
|
TOOLCHAIN_REF: ${{ steps.toolchain_tag.outputs.ref }}
|
|
run: |
|
|
$ErrorActionPreference = 'Continue'
|
|
$PSNativeCommandUseErrorActionPreference = $false
|
|
|
|
$toolchainRef = "$env:TOOLCHAIN_REF"
|
|
|
|
if ([string]::IsNullOrWhiteSpace($toolchainRef)) {
|
|
throw 'TOOLCHAIN_REF is empty. Check toolchain_tag step outputs.'
|
|
}
|
|
|
|
docker manifest inspect "$toolchainRef" *> $null
|
|
|
|
if ($LASTEXITCODE -eq 0) {
|
|
Add-Content -Path $env:GITHUB_OUTPUT -Value 'reuse=true'
|
|
Write-Host "Toolchain '$toolchainRef' image exists, will reuse it."
|
|
}
|
|
else {
|
|
Add-Content -Path $env:GITHUB_OUTPUT -Value 'reuse=false'
|
|
Write-Host "Toolchain '$toolchainRef' image is missing, will build it."
|
|
}
|
|
|
|
$global:LASTEXITCODE = 0
|
|
exit 0
|
|
|
|
- name: Generate tags
|
|
id: meta
|
|
if: ${{ steps.toolchain_lookup.outputs.reuse != 'true' }}
|
|
uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
|
|
with:
|
|
images: ${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, env.BASE_IMAGE_NAME ) }}
|
|
context: ${{ env.TRUNK_ONLY_EVENT == 'true' && 'git' || '' }}
|
|
tags: |
|
|
type=semver,enable=${{ needs.init_build.outputs.current_branch != 'trunk' }},pattern={{version}},prefix=${{ matrix.component }}-${{ steps.base_os_tag.outputs.os_tag }}-
|
|
type=semver,enable=${{ needs.init_build.outputs.current_branch != 'trunk' }},pattern={{version}},suffix=-${{ steps.base_os_tag.outputs.os_tag }},prefix=${{ matrix.component }}-
|
|
type=ref,enable=${{ needs.init_build.outputs.current_branch != 'trunk' }},event=branch,prefix=${{ matrix.component }}-${{ steps.base_os_tag.outputs.os_tag }}-,suffix=-latest
|
|
type=ref,enable=${{ needs.init_build.outputs.current_branch != 'trunk' }},event=branch,suffix=-${{ steps.base_os_tag.outputs.os_tag }}-latest,prefix=${{ matrix.component }}-
|
|
type=raw,enable=${{ needs.init_build.outputs.current_branch != 'trunk' && needs.init_build.outputs.is_default_branch == 'true' }},value=${{ matrix.component }}-${{ steps.base_os_tag.outputs.os_tag }}-latest
|
|
type=ref,enable=${{ needs.init_build.outputs.current_branch == 'trunk' }},event=branch,prefix=${{ matrix.component }}-${{ steps.base_os_tag.outputs.os_tag }}-
|
|
type=ref,enable=${{ needs.init_build.outputs.current_branch == 'trunk' }},event=branch,suffix=-${{ steps.base_os_tag.outputs.os_tag }},prefix=${{ matrix.component }}-
|
|
flavor: |
|
|
latest=false
|
|
|
|
- name: Login to DockerHub
|
|
if: ${{ steps.toolchain_lookup.outputs.reuse != 'true' }}
|
|
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
|
|
with:
|
|
username: ${{ secrets.DOCKER_USERNAME }}
|
|
password: ${{ secrets.DOCKER_PASSWORD }}
|
|
|
|
- name: Build and push image
|
|
id: docker_build
|
|
if: ${{ steps.toolchain_lookup.outputs.reuse != 'true' }}
|
|
uses: ./.github/actions/docker-build-push-windows
|
|
with:
|
|
context: ${{ format('{0}/{1}/windows', env.DOCKERFILES_DIRECTORY, env.BASE_IMAGE_NAME) }}
|
|
dockerfile: ${{ format('{0}\{1}\windows\Dockerfile.{2}', env.DOCKERFILES_DIRECTORY, env.BASE_IMAGE_NAME, matrix.component ) }}
|
|
tags: |
|
|
${{ steps.meta.outputs.tags }}
|
|
${{ steps.toolchain_tag.outputs.ref }}
|
|
label_revision: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
|
|
label_created: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
|
|
pull_images: |
|
|
${{ env.MSFT_BASE_BUILD_IMAGE }}:${{ steps.base_os_tag.outputs.os_tag }}
|
|
build_args: |
|
|
OS_BASE_IMAGE=${{ env.MSFT_BASE_BUILD_IMAGE }}:${{ steps.base_os_tag.outputs.os_tag }}
|
|
push: true
|
|
|
|
- name: Sign the images with GitHub OIDC Token
|
|
if: ${{ steps.toolchain_lookup.outputs.reuse != 'true' }}
|
|
uses: ./.github/actions/cosign-sign
|
|
with:
|
|
digest: ${{ steps.docker_build.outputs.digest }}
|
|
tags: |
|
|
${{ steps.meta.outputs.tags }}
|
|
${{ steps.toolchain_tag.outputs.ref }}
|
|
|
|
- name: Attest images
|
|
if: ${{ steps.toolchain_lookup.outputs.reuse != 'true' }}
|
|
uses: ./.github/actions/attest-image
|
|
with:
|
|
subject_name: ${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, env.BASE_IMAGE_NAME ) }}
|
|
subject_digest: ${{ steps.docker_build.outputs.digest }}
|
|
|
|
- name: Image ref
|
|
env:
|
|
DIGEST: ${{ steps.docker_build.outputs.digest }}
|
|
IMAGE: ${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, env.BASE_IMAGE_NAME ) }}
|
|
REUSE: ${{ steps.toolchain_lookup.outputs.reuse }}
|
|
REUSE_IMAGE_REF: ${{ steps.toolchain_tag.outputs.ref }}
|
|
CACHE_FILE_NAME: ${{ env.BASE_IMAGE_NAME }}_${{ matrix.os }}_${{ matrix.component }}
|
|
run: |
|
|
$reuse = "$env:REUSE"
|
|
$image = "$env:IMAGE"
|
|
$digest = "$env:DIGEST"
|
|
$reuseImageRef = "$env:REUSE_IMAGE_REF"
|
|
$cacheFileName = "$env:CACHE_FILE_NAME"
|
|
|
|
if ($reuse -eq 'true') {
|
|
$imageRef = "$reuseImageRef"
|
|
}
|
|
else {
|
|
if ([string]::IsNullOrWhiteSpace($digest)) {
|
|
throw 'Built image digest is empty'
|
|
}
|
|
|
|
$imageRef = "${image}@${digest}"
|
|
}
|
|
|
|
if ([string]::IsNullOrWhiteSpace($imageRef)) {
|
|
throw 'Image ref is empty'
|
|
}
|
|
|
|
echo "::group::Image ref"
|
|
echo "$imageRef"
|
|
echo "::endgroup::"
|
|
|
|
echo "::group::Cache file name"
|
|
echo "$cacheFileName"
|
|
echo "::endgroup::"
|
|
|
|
Set-Content -Path $cacheFileName -Value $imageRef -NoNewline
|
|
|
|
- name: Upload artifact metadata
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
path: ${{ env.BASE_IMAGE_NAME }}_${{ matrix.os }}_${{ matrix.component }}
|
|
name: ${{ env.BASE_IMAGE_NAME }}-${{ matrix.os }}-${{ matrix.component }}-${{ github.run_id }}
|
|
|
|
build_components:
|
|
name: Build ${{ matrix.component }} sources on ${{ matrix.os }}
|
|
needs: ["build_base", "init_build"]
|
|
runs-on: ${{ matrix.os }}
|
|
timeout-minutes: 70
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
attestations: write
|
|
artifact-metadata: write
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os: ${{ fromJson(needs.init_build.outputs.os) }}
|
|
component: ${{ fromJson(needs.init_build.outputs.components) }}
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
ref: ${{ env.TRUNK_ONLY_EVENT == 'true' && env.TRUNK_GIT_BRANCH || '' }}
|
|
fetch-depth: 1
|
|
|
|
- name: Install cosign
|
|
uses: ./.github/actions/cosign-install
|
|
|
|
- name: Login to DockerHub
|
|
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
|
|
with:
|
|
username: ${{ secrets.DOCKER_USERNAME }}
|
|
password: ${{ secrets.DOCKER_PASSWORD }}
|
|
|
|
- name: Base OS tag
|
|
id: base_os_tag
|
|
env:
|
|
MATRIX_OS: ${{ matrix.os }}
|
|
MATRIX_FILE: ${{ env.MATRIX_FILE }}
|
|
run: |
|
|
$matrixFile = "$env:MATRIX_FILE"
|
|
$matrixOs = "$env:MATRIX_OS"
|
|
|
|
$osTag = (Get-Content -Path $matrixFile | ConvertFrom-Json).'os-windows'."$matrixOs"
|
|
|
|
if ([string]::IsNullOrWhiteSpace($osTag)) {
|
|
throw "Failed to detect Windows base OS tag for '$matrixOs'"
|
|
}
|
|
|
|
echo "::group::Base Windows OS tag"
|
|
echo "$osTag"
|
|
echo "::endgroup::"
|
|
|
|
Add-Content -Path $env:GITHUB_OUTPUT -Value "os_tag=$osTag"
|
|
|
|
- name: Generate tags
|
|
id: meta
|
|
uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
|
|
with:
|
|
images: ${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, env.BASE_BUILD_IMAGE_NAME ) }}
|
|
context: ${{ env.TRUNK_ONLY_EVENT == 'true' && 'git' || '' }}
|
|
tags: |
|
|
type=semver,enable=${{ needs.init_build.outputs.current_branch != 'trunk' }},pattern={{version}},prefix=${{ matrix.component }}-${{ steps.base_os_tag.outputs.os_tag }}-
|
|
type=semver,enable=${{ needs.init_build.outputs.current_branch != 'trunk' }},pattern={{version}},suffix=-${{ steps.base_os_tag.outputs.os_tag }},prefix=${{ matrix.component }}-
|
|
type=ref,enable=${{ needs.init_build.outputs.current_branch != 'trunk' }},event=branch,prefix=${{ matrix.component }}-${{ steps.base_os_tag.outputs.os_tag }}-,suffix=-latest
|
|
type=ref,enable=${{ needs.init_build.outputs.current_branch != 'trunk' }},event=branch,suffix=-${{ steps.base_os_tag.outputs.os_tag }}-latest,prefix=${{ matrix.component }}-
|
|
type=raw,enable=${{ (needs.init_build.outputs.current_branch != 'trunk') && (needs.init_build.outputs.is_default_branch == 'true') }},value=${{ matrix.component }}-${{ steps.base_os_tag.outputs.os_tag }}-latest
|
|
type=ref,enable=${{ needs.init_build.outputs.current_branch == 'trunk' }},event=branch,prefix=${{ matrix.component }}-${{ steps.base_os_tag.outputs.os_tag }}-
|
|
type=ref,enable=${{ needs.init_build.outputs.current_branch == 'trunk' }},event=branch,suffix=-${{ steps.base_os_tag.outputs.os_tag }},prefix=${{ matrix.component }}-
|
|
flavor: |
|
|
latest=false
|
|
|
|
- name: Download image ref of ${{ env.BASE_IMAGE_NAME }}:${{ matrix.os }}
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: ${{ env.BASE_IMAGE_NAME }}-${{ matrix.os }}-${{ matrix.component }}-${{ github.run_id }}
|
|
|
|
- name: Retrieve ${{ env.BASE_IMAGE_NAME }}:${{ matrix.os }} image ref
|
|
id: base_build
|
|
env:
|
|
BASE_IMAGE_FILE: ${{ format('{0}_{1}_{2}', env.BASE_IMAGE_NAME, matrix.os, matrix.component) }}
|
|
run: |
|
|
$baseImageFile = "$env:BASE_IMAGE_FILE"
|
|
|
|
if (-not (Test-Path $baseImageFile)) {
|
|
throw "Missing cached base image ref file: $baseImageFile"
|
|
}
|
|
|
|
$buildBaseImage = (Get-Content $baseImageFile -Raw).Trim()
|
|
if ([string]::IsNullOrWhiteSpace($buildBaseImage)) {
|
|
throw "Base image ref is empty in file: $baseImageFile"
|
|
}
|
|
|
|
echo "::group::Base image info"
|
|
echo "base_build_image=$buildBaseImage"
|
|
echo "::endgroup::"
|
|
|
|
Add-Content -Path $env:GITHUB_OUTPUT -Value "base_build_image=$buildBaseImage"
|
|
|
|
- name: Verify ${{ env.BASE_IMAGE_NAME }}:${{ matrix.os }} cosign
|
|
uses: ./.github/actions/cosign-verify
|
|
with:
|
|
image: ${{ steps.base_build.outputs.base_build_image }}
|
|
oidc_issuer: ${{ env.OIDC_ISSUER }}
|
|
identity_regexp: ${{ env.IDENTITY_REGEX }}
|
|
|
|
- name: Build and push image
|
|
id: docker_build
|
|
uses: ./.github/actions/docker-build-push-windows
|
|
with:
|
|
context: ${{ env.DOCKERFILES_DIRECTORY }}\${{ env.BASE_BUILD_IMAGE_NAME }}\windows
|
|
dockerfile: ${{ env.DOCKERFILES_DIRECTORY }}\${{ env.BASE_BUILD_IMAGE_NAME }}\windows\Dockerfile.${{ matrix.component }}
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
label_revision: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
|
|
label_created: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
|
|
pull_images: |
|
|
${{ steps.base_build.outputs.base_build_image }}
|
|
build_args: |
|
|
BUILD_BASE_IMAGE=${{ steps.base_build.outputs.base_build_image }}
|
|
push: true
|
|
|
|
- name: Attest images
|
|
uses: ./.github/actions/attest-image
|
|
with:
|
|
subject_name: ${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, env.BASE_BUILD_IMAGE_NAME ) }}
|
|
subject_digest: ${{ steps.docker_build.outputs.digest }}
|
|
|
|
- name: Sign the images with GitHub OIDC Token
|
|
uses: ./.github/actions/cosign-sign
|
|
with:
|
|
digest: ${{ steps.docker_build.outputs.digest }}
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
|
|
- name: Image ref
|
|
env:
|
|
DIGEST: ${{ steps.docker_build.outputs.digest }}
|
|
IMAGE: ${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, env.BASE_BUILD_IMAGE_NAME ) }}
|
|
CACHE_FILE_NAME: ${{ env.BASE_BUILD_IMAGE_NAME }}_${{ matrix.os }}_${{ matrix.component }}
|
|
run: |
|
|
$digest = "$env:DIGEST"
|
|
$image = "$env:IMAGE"
|
|
$cacheFileName = "$env:CACHE_FILE_NAME"
|
|
|
|
if ([string]::IsNullOrWhiteSpace($digest)) {
|
|
throw 'Built image digest is empty'
|
|
}
|
|
|
|
$imageRef = "${image}@${digest}"
|
|
|
|
echo "::group::Image ref"
|
|
echo "$imageRef"
|
|
echo "::endgroup::"
|
|
|
|
echo "::group::Cache file name"
|
|
echo "$cacheFileName"
|
|
echo "::endgroup::"
|
|
|
|
Set-Content -Path $cacheFileName -Value $imageRef -NoNewline
|
|
|
|
- name: Upload artifact metadata
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
path: ${{ env.BASE_BUILD_IMAGE_NAME }}_${{ matrix.os }}_${{ matrix.component }}
|
|
name: ${{ env.BASE_BUILD_IMAGE_NAME }}-${{ matrix.os }}-${{ matrix.component }}-${{ github.run_id }}
|
|
|
|
build_images:
|
|
name: Build ${{ matrix.component }} on ${{ matrix.os }}
|
|
needs: ["build_components", "init_build"]
|
|
runs-on: ${{ matrix.os }}
|
|
timeout-minutes: 70
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
attestations: write
|
|
artifact-metadata: write
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os: ${{ fromJson(needs.init_build.outputs.os) }}
|
|
component: ${{ fromJson(needs.init_build.outputs.components) }}
|
|
|
|
steps:
|
|
- name: Block egress traffic
|
|
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
|
|
with:
|
|
disable-sudo: true
|
|
egress-policy: block
|
|
disable-telemetry: true
|
|
allowed-endpoints: >
|
|
api.github.com:443
|
|
auth.docker.io:443
|
|
dc.services.visualstudio.com:443
|
|
fulcio.sigstore.dev:443
|
|
github.com:443
|
|
index.docker.io:443
|
|
mcr.microsoft.com:443
|
|
mobile.events.data.microsoft.com:443
|
|
ocsp.sectigo.com:80
|
|
production.cloudflare.docker.com:443
|
|
r12.c.lencr.org:80
|
|
registry-1.docker.io:443
|
|
rekor.sigstore.dev:443
|
|
timestamp.sigstore.dev:443
|
|
tuf-repo-cdn.sigstore.dev:443
|
|
x1.c.lencr.org:80
|
|
|
|
- name: Checkout repository
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
ref: ${{ env.TRUNK_ONLY_EVENT == 'true' && env.TRUNK_GIT_BRANCH || '' }}
|
|
fetch-depth: 1
|
|
|
|
- name: Install cosign
|
|
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
|
|
uses: ./.github/actions/cosign-install
|
|
|
|
- name: Login to DockerHub
|
|
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
|
|
with:
|
|
username: ${{ secrets.DOCKER_USERNAME }}
|
|
password: ${{ secrets.DOCKER_PASSWORD }}
|
|
|
|
- name: Base OS tag
|
|
id: base_os_tag
|
|
env:
|
|
MATRIX_OS: ${{ matrix.os }}
|
|
MATRIX_FILE: ${{ env.MATRIX_FILE }}
|
|
run: |
|
|
$matrixFile = "$env:MATRIX_FILE"
|
|
$matrixOs = "$env:MATRIX_OS"
|
|
|
|
$osTag = (Get-Content -Path $matrixFile | ConvertFrom-Json).'os-windows'."$matrixOs"
|
|
|
|
if ([string]::IsNullOrWhiteSpace($osTag)) {
|
|
throw "Failed to detect Windows base OS tag for '$matrixOs'"
|
|
}
|
|
|
|
echo "::group::Base OS tag"
|
|
echo "$osTag"
|
|
echo "::endgroup::"
|
|
|
|
Add-Content -Path $env:GITHUB_OUTPUT -Value "os_tag=$osTag"
|
|
|
|
- name: Generate tags
|
|
id: meta
|
|
uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
|
|
with:
|
|
images: ${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, matrix.component ) }}
|
|
context: ${{ env.TRUNK_ONLY_EVENT == 'true' && 'git' || '' }}
|
|
tags: |
|
|
type=semver,enable=${{ needs.init_build.outputs.current_branch != 'trunk' }},pattern={{version}},prefix=${{ steps.base_os_tag.outputs.os_tag }}-
|
|
type=semver,enable=${{ needs.init_build.outputs.current_branch != 'trunk' }},pattern={{version}},suffix=-${{ steps.base_os_tag.outputs.os_tag }}
|
|
type=ref,enable=${{ needs.init_build.outputs.current_branch != 'trunk' }},event=branch,prefix=${{ steps.base_os_tag.outputs.os_tag }}-,suffix=-latest
|
|
type=ref,enable=${{ needs.init_build.outputs.current_branch != 'trunk' }},event=branch,suffix=-${{ steps.base_os_tag.outputs.os_tag }}-latest
|
|
type=raw,enable=${{ (needs.init_build.outputs.current_branch != 'trunk') && (needs.init_build.outputs.is_default_branch == 'true') }},value=${{ steps.base_os_tag.outputs.os_tag }}-latest
|
|
type=ref,enable=${{ needs.init_build.outputs.current_branch == 'trunk' }},event=branch,prefix=${{ steps.base_os_tag.outputs.os_tag }}-
|
|
type=ref,enable=${{ needs.init_build.outputs.current_branch == 'trunk' }},event=branch,suffix=-${{ steps.base_os_tag.outputs.os_tag }}
|
|
flavor: |
|
|
latest=false
|
|
|
|
- name: Download image ref of ${{ env.BASE_BUILD_IMAGE_NAME }}:${{ matrix.os }}
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: ${{ env.BASE_BUILD_IMAGE_NAME }}-${{ matrix.os }}-${{ matrix.component }}-${{ github.run_id }}
|
|
|
|
- name: Retrieve ${{ env.BASE_BUILD_IMAGE_NAME }}:${{ matrix.os }} image ref
|
|
id: base_build
|
|
env:
|
|
BASE_IMAGE_FILE: ${{ format('{0}_{1}_{2}', env.BASE_BUILD_IMAGE_NAME, matrix.os, matrix.component) }}
|
|
run: |
|
|
$baseImageFile = "$env:BASE_IMAGE_FILE"
|
|
|
|
if (-not (Test-Path $baseImageFile)) {
|
|
throw "Missing cached build-components image ref file: $baseImageFile"
|
|
}
|
|
|
|
$buildBaseImage = (Get-Content $baseImageFile -Raw).Trim()
|
|
if ([string]::IsNullOrWhiteSpace($buildBaseImage)) {
|
|
throw "Build-components image ref is empty in file: $baseImageFile"
|
|
}
|
|
|
|
echo "::group::Base image info"
|
|
echo "base_build_image=$buildBaseImage"
|
|
echo "::endgroup::"
|
|
|
|
Add-Content -Path $env:GITHUB_OUTPUT -Value "base_build_image=$buildBaseImage"
|
|
|
|
- name: Verify ${{ env.BASE_BUILD_IMAGE_NAME }}:${{ matrix.os }} cosign
|
|
uses: ./.github/actions/cosign-verify
|
|
with:
|
|
image: ${{ steps.base_build.outputs.base_build_image }}
|
|
oidc_issuer: ${{ env.OIDC_ISSUER }}
|
|
identity_regexp: ${{ env.IDENTITY_REGEX }}
|
|
|
|
- name: Build and push image
|
|
id: docker_build
|
|
uses: ./.github/actions/docker-build-push-windows
|
|
with:
|
|
context: .
|
|
dockerfile: ${{ env.DOCKERFILES_DIRECTORY }}\${{ matrix.component }}\windows\Dockerfile
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
label_revision: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.revision'] }}
|
|
label_created: ${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
|
|
pull_images: |
|
|
${{ steps.base_build.outputs.base_build_image }}
|
|
${{ env.OS_BASE_IMAGE_NAME }}:${{ steps.base_os_tag.outputs.os_tag }}
|
|
${{ env.ENTRYPOINT_BUILD_IMAGE_NAME }}-${{ steps.base_os_tag.outputs.os_tag }}
|
|
build_args: |
|
|
BUILD_BASE_IMAGE=${{ steps.base_build.outputs.base_build_image }}
|
|
OS_BASE_IMAGE=${{ env.OS_BASE_IMAGE_NAME }}:${{ steps.base_os_tag.outputs.os_tag }}
|
|
ENTRYPOINT_BUILD_IMAGE=${{ env.ENTRYPOINT_BUILD_IMAGE_NAME }}-${{ steps.base_os_tag.outputs.os_tag }}
|
|
push: ${{ env.AUTO_PUSH_IMAGES }}
|
|
remove_readme: false
|
|
|
|
- name: Sign the images with GitHub OIDC Token
|
|
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
|
|
uses: ./.github/actions/cosign-sign
|
|
with:
|
|
digest: ${{ steps.docker_build.outputs.digest }}
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
|
|
- name: Attest images
|
|
uses: ./.github/actions/attest-image
|
|
with:
|
|
subject_name: ${{ format('{0}/{1}/{2}{3}', env.DOCKER_REGISTRY, env.DOCKER_REPOSITORY, env.IMAGES_PREFIX, matrix.component ) }}
|
|
subject_digest: ${{ steps.docker_build.outputs.digest }}
|