fix(deps): update dependencies (patch & digest) #1785
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker | |
| permissions: | |
| contents: read | |
| on: | |
| release: | |
| types: | |
| - published | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - v* | |
| paths-ignore: | |
| - "docs/**" | |
| - "**/*.md" | |
| pull_request: | |
| paths-ignore: | |
| - "docs/**" | |
| - "**/*.md" | |
| types: [labeled, unlabeled, opened, synchronize, reopened] | |
| jobs: | |
| buildAndPush: | |
| strategy: | |
| matrix: | |
| image: | |
| - name: arc-controller-manager | |
| context: . | |
| target: manager | |
| - name: arc-apiserver | |
| context: . | |
| target: apiserver | |
| - name: ocm-tools | |
| context: examples/ocm | |
| target: "" | |
| ocmVersion: "0.46.0" | |
| permissions: | |
| actions: read | |
| contents: read | |
| packages: write # Push to ghcr.io | |
| id-token: write # Needed to create an OIDC token for keyless signing | |
| attestations: write # Write attestations to GitHub API as well | |
| name: Build and Publish Docker Image | |
| # Condition: Run on push to main, published release, PR with 'ok-to-image' label, or any workflow_call (caller already decided) | |
| if: | | |
| github.event_name == 'push' || | |
| (github.event_name == 'pull_request' && ( | |
| contains(toJSON(github.event.pull_request.labels), '"ok-to-image"') || | |
| contains(toJSON(github.event.pull_request.labels), '"ok-to-e2e"') | |
| )) || | |
| (github.event_name == 'release' && github.event.action == 'published') | |
| runs-on: ubuntu-24.04 | |
| outputs: | |
| image-tag: ${{ steps.meta.outputs.version }} | |
| is-local: ${{ env.ACT == 'true' }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Setup Local Registry for act | |
| if: ${{ env.ACT == 'true' }} | |
| run: | | |
| if ! docker ps | grep -q act-registry; then | |
| docker run -d -p 5001:5000 --name act-registry registry:2 | |
| fi | |
| - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6 | |
| id: meta | |
| with: | |
| images: | | |
| ${{ env.ACT == 'true' && 'localhost:5001/local' || format('ghcr.io/{0}', github.repository_owner) }}/${{ matrix.image.name }} | |
| tags: | | |
| type=semver,pattern={{version}} | |
| type=schedule | |
| type=ref,event=branch | |
| type=ref,event=tag | |
| type=ref,event=pr | |
| type=sha | |
| ${{ matrix.image.name == 'ocm-tools' && github.ref == 'refs/heads/main' && format('type=raw,value={0}', matrix.image.ocmVersion) || '' }} | |
| flavor: | | |
| latest=${{ matrix.image.name != 'ocm-tools' && github.ref == 'refs/heads/main' }} | |
| - name: Set up QEMU | |
| if: ${{ env.ACT != 'true' }} | |
| uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4 | |
| with: | |
| platforms: arm64 | |
| - name: Set up Docker Buildx | |
| timeout-minutes: 5 | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 | |
| with: | |
| version: latest | |
| driver-opts: ${{ env.ACT == 'true' && 'network=host' || '' }} | |
| - name: Login to GHCR | |
| if: ${{ env.ACT != 'true' }} | |
| uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push | |
| id: image | |
| timeout-minutes: 20 | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 | |
| with: | |
| context: ${{ matrix.image.context }} | |
| platforms: ${{ env.ACT == 'true' && 'linux/amd64' || 'linux/amd64,linux/arm64' }} | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| target: ${{ matrix.image.target }} | |
| build-args: ${{ matrix.image.name == 'ocm-tools' && format('OCM_VERSION={0}', matrix.image.ocmVersion) || '' }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Install cosign | |
| if: ${{ env.ACT != 'true' }} | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| - name: Sign image with cosign | |
| if: ${{ env.ACT != 'true' }} | |
| env: | |
| COSIGN_EXPERIMENTAL: 1 | |
| run: | | |
| IFS=',' read -ra TAGS <<< "${{ steps.meta.outputs.tags }}" | |
| for tag in "${TAGS[@]}"; do | |
| cosign sign \ | |
| -a "repo=${{ github.repository }}" \ | |
| -a "workflow=${{ github.workflow }}" \ | |
| -a "sha=${{ github.sha }}" \ | |
| --yes \ | |
| "$tag"@${{ steps.image.outputs.digest }} | |
| done | |
| - name: Extract first tag | |
| id: first-tag | |
| run: | | |
| IFS=$'\n' read -ra TAGS <<< "${{ steps.meta.outputs.tags }}" | |
| echo "tag=${TAGS[0]}" >> $GITHUB_OUTPUT | |
| - name: Generate SBOM | |
| if: ${{ env.ACT != 'true' }} | |
| uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0 | |
| with: | |
| image: ${{ steps.first-tag.outputs.tag }} | |
| format: 'cyclonedx-json' | |
| output-file: 'sbom.cyclonedx.json' | |
| upload-release-assets: false # we use immutable releases | |
| - name: Attest SBOM | |
| if: ${{ env.ACT != 'true' }} | |
| uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4 | |
| with: | |
| subject-name: ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }} | |
| subject-digest: ${{ steps.image.outputs.digest }} | |
| sbom-path: 'sbom.cyclonedx.json' | |
| push-to-registry: true | |
| - name: Attest provenance | |
| if: ${{ env.ACT != 'true' }} | |
| uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4 | |
| with: | |
| subject-name: ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }} | |
| subject-digest: ${{ steps.image.outputs.digest }} | |
| push-to-registry: true | |
| test-e2e: | |
| needs: buildAndPush | |
| if: needs.buildAndPush.result == 'success' | |
| uses: ./.github/workflows/test-e2e.yaml | |
| with: | |
| image-tag: ${{ needs.buildAndPush.outputs.image-tag }} | |
| is-local: ${{ fromJson(needs.buildAndPush.outputs.is-local) }} | |
| permissions: | |
| contents: read | |
| packages: read |