Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

build/ENGEN-844 review #10273

Merged
merged 4 commits into from
Feb 9, 2023
Merged

build/ENGEN-844 review #10273

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4012511
chore(gha): cleanup trailing whitespace
curiositycasualty Feb 9, 2023
6fb996a
chore(gha): simplify release scan image as ENV
curiositycasualty Feb 9, 2023
b1736c1
chore(gha): simplify release scan logic
curiositycasualty Feb 9, 2023
da63512
fix(gha): release scan IMAGE context
curiositycasualty Feb 9, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 18 additions & 9 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,7 +151,7 @@ jobs:
if: matrix.package == 'deb' && steps.cache-deps.outputs.cache-hit != 'true'
run: |
sudo apt-get update && sudo apt-get install libyaml-dev -y

- name: Install Ubuntu Cross Build Dependencies (arm64)
if: matrix.package == 'deb' && steps.cache-deps.outputs.cache-hit != 'true' && endsWith(matrix.label, 'arm64')
run: |
Expand Down Expand Up @@ -327,14 +327,16 @@ jobs:
needs: [metadata, build-images]
runs-on: ubuntu-22.04
if: |-
always()
&& fromJSON(needs.metadata.outputs.matrix)['build-images'] != ''
&& needs.build-images.result == 'success'
always()
&& fromJSON(needs.metadata.outputs.matrix)['build-images'] != ''
&& needs.build-images.result == 'success'
&& (github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]'))
strategy:
fail-fast: false
matrix:
include: "${{ fromJSON(needs.metadata.outputs.matrix)['build-images'] }}"
env:
IMAGE: ${{ needs.metadata.outputs.prerelease-docker-repository }}:${{ github.sha }}-${{ matrix.label }}
steps:
- name: Install regctl
uses: regclient/actions/regctl-installer@main
Expand All @@ -351,11 +353,18 @@ jobs:
- name: Parse Architecture Specific Image Manifest Digests
id: image_manifest_metadata
run: |
manifest_list_exists=$(regctl manifest get ${{ needs.metadata.outputs.prerelease-docker-repository }}:${{ github.sha }}-${{ matrix.label }} --format raw-body --require-list -v panic &> /dev/null && echo true || echo false)
amd64_sha=$(regctl image digest ${{ needs.metadata.outputs.prerelease-docker-repository }}:${{ github.sha }}-${{ matrix.label }} --platform linux/amd64 || echo '')
arm64_sha=$(regctl image digest ${{ needs.metadata.outputs.prerelease-docker-repository }}:${{ github.sha }}-${{ matrix.label }} --platform linux/arm64 || echo '')
manifest_list_exists="$(
if regctl manifest get "${IMAGE}" --format raw-body --require-list -v panic 2>&1 >/dev/null; then
echo true
else
echo false
fi
)"
echo "manifest_list_exists=$manifest_list_exists"
echo "manifest_list_exists=$manifest_list_exists" >> $GITHUB_OUTPUT

amd64_sha="$(regctl image digest "${IMAGE}" --platform linux/amd64 || echo '')"
arm64_sha="$(regctl image digest "${IMAGE}" --platform linux/arm64 || echo '')"
echo "amd64_sha=$amd64_sha"
echo "amd64_sha=$amd64_sha" >> $GITHUB_OUTPUT
echo "arm64_sha=$arm64_sha"
Expand All @@ -367,15 +376,15 @@ jobs:
uses: Kong/public-shared-actions/security-actions/scan-docker-image@b2e4a29d30382e1cceeda8df1e8b8bee65bef39b
with:
asset_prefix: kong-${{ github.sha }}-${{ matrix.label }}-linux-amd64
image: ${{ needs.metadata.outputs.prerelease-docker-repository }}:${{ github.sha }}-${{ matrix.label }}@${{ steps.image_manifest_metadata.outputs.amd64_sha }}
image: ${{env.IMAGE}}@${{ steps.image_manifest_metadata.outputs.amd64_sha }}

- name: Scan ARM64 Image digest
if: steps.image_manifest_metadata.outputs.manifest_list_exists == 'true' && steps.image_manifest_metadata.outputs.arm64_sha != ''
id: sbom_action_arm64
uses: Kong/public-shared-actions/security-actions/scan-docker-image@b2e4a29d30382e1cceeda8df1e8b8bee65bef39b
with:
asset_prefix: kong-${{ github.sha }}-${{ matrix.label }}-linux-arm64
image: ${{ needs.metadata.outputs.prerelease-docker-repository }}:${{ github.sha }}-${{ matrix.label }}@${{ steps.image_manifest_metadata.outputs.arm64_sha }}
image: ${{env.IMAGE}}@${{ steps.image_manifest_metadata.outputs.arm64_sha }}

smoke-tests:
name: Smoke Tests - ${{ matrix.label }}
Expand Down