Migrate to Github Actions

.github/workflows/build.yml

@@ -0,0 +1,71 @@
+on:
+  push:
+    branches:
+    - master
+  pull_request:
+
+
+permissions:
+  contents: read
+  security-events: write # upload Sarif results
+
+name: Build
+jobs:
+  build-amd64:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Set the TAG value
+      id: get-TAG
+      run: |
+        echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV"
+    - name: Build container image
+      uses: docker/build-push-action@v5
+      with:
+        context: .
+        push: false
+        tags: rancher/hardened-cni-plugins:${{ env.TAG }}-amd64
+        file: Dockerfile
+
+    - name: Run Trivy vulnerability scanner
+      uses: aquasecurity/[email protected]
+      with:
+        image-ref: rancher/hardened-cni-plugins:${{ env.TAG }}-amd64
+        ignore-unfixed: true
+        vuln-type: 'os,library'
+        severity: 'CRITICAL,HIGH'
+        format: 'sarif'
+        output: 'trivy-results.sarif'
+    - name: Upload Trivy scan results to GitHub Security tab
+      uses: github/codeql-action/upload-sarif@v3
+      if: always()
+      with:
+        sarif_file: 'trivy-results.sarif'
+
+  build-arm64:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Check out code
+      uses: actions/checkout@v4
+
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v3
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Set the TAG value
+      id: get-TAG
+      run: |
+        echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV"
+    - name: Build container image
+      uses: docker/build-push-action@v5
+      with:
+        context: .
+        push: false
+        tags: rancher/hardened-cni-plugins:${{ env.TAG }}-arm64
+        file: Dockerfile
+        outputs: type=docker
+        platforms: linux/arm64

.github/workflows/image-push.yml

@@ -0,0 +1,44 @@
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read  
+
+jobs:
+  push-multiarch:
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    steps:
+    - name: Check out code
+      uses: actions/checkout@v4
+
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v3
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: "Read secrets"
+      uses: rancher-eio/read-vault-secrets@main
+      with:
+        secrets: |
+          secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials username | DOCKER_USERNAME ;
+          secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials password | DOCKER_PASSWORD
+
+    - name: Login to Container Registry
+      uses: docker/login-action@v3
+      with:
+        username: ${{ env.DOCKER_USERNAME }}
+        password: ${{ env.DOCKER_PASSWORD }}
+
+    - name: Build container image
+      uses: docker/build-push-action@v5
+      with:
+        context: .
+        push: true
+        tags: rancher/hardened-cni-plugins:${{ github.event.release.tag_name }}
+        file: Dockerfile
+        platforms: linux/amd64, linux/arm64

Dockerfile

@@ -1,17 +1,29 @@
 ARG BCI_IMAGE=registry.suse.com/bci/bci-busybox
 ARG GO_IMAGE=rancher/hardened-build-base:v1.20.14b1
 ARG GOEXPERIMENT=boringcrypto
+ARG ARCH="amd64"
+
+# Image that provides cross compilation tooling.
+FROM --platform=$BUILDPLATFORM rancher/mirrored-tonistiigi-xx:1.3.0 as xx
 
 ### Build the cni-plugins ###
-FROM ${GO_IMAGE} as cni_plugins
-ARG ARCH=amd64
+FROM --platform=$BUILDPLATFORM ${GO_IMAGE} as cni_plugins_builder
+# copy xx scripts to your build stage
+COPY --from=xx / /
+RUN apk add file make git clang lld
+ARG TARGETPLATFORM
+# setup required packages
+RUN set -x && \
+    xx-apk --no-cache add musl-dev gcc lld 
+
 ARG TAG=v1.4.1
 ARG FLANNEL_TAG=v1.4.0-flannel1
 ARG GOEXPERIMENT
 RUN git clone --depth=1 https://github.com/containernetworking/plugins.git $GOPATH/src/github.com/containernetworking/plugins && \
     cd $GOPATH/src/github.com/containernetworking/plugins && \
     git fetch --all --tags --prune && \
     git checkout tags/${TAG} -b ${TAG} && \
+    xx-go --wrap\
     sh -ex ./build_linux.sh -v \
         -gcflags=-trimpath=/go/src \
         -ldflags " \
@@ -22,10 +34,15 @@ RUN git clone --depth=1 https://github.com/flannel-io/cni-plugin $GOPATH/src/git
     cd $GOPATH/src/github.com/flannel-io/cni-plugin && \
     git fetch --all --tags --prune && \
     git checkout tags/${FLANNEL_TAG} -b ${FLANNEL_TAG} && \
+    export GOOS=$(xx-info os) &&\
+    export GOARCH=$(xx-info arch) &&\
+    export ARCH=$(xx-info arch) &&\
     make build_linux && \
+    mkdir -p $GOPATH/src/github.com/containernetworking/plugins/bin && \
     mv $GOPATH/src/github.com/flannel-io/cni-plugin/dist/flannel-${ARCH} $GOPATH/src/github.com/containernetworking/plugins/bin/flannel
 
 WORKDIR $GOPATH/src/github.com/containernetworking/plugins
+RUN xx-verify --static bin/*
 RUN go-assert-static.sh bin/* && \
     if [ "${ARCH}" = "amd64" ]; then \
         go-assert-boring.sh bin/bandwidth \
@@ -41,11 +58,19 @@ RUN go-assert-static.sh bin/* && \
         bin/vlan ; \
     fi && \
     mkdir -vp /opt/cni/bin && \
-    install -D -s bin/* /opt/cni/bin
+    install -D bin/* /opt/cni/bin
+
+FROM ${GO_IMAGE} as strip_binary
+#strip needs to run on TARGETPLATFORM, not BUILDPLATFORM
+COPY --from=cni_plugins_builder /opt/cni/ /opt/cni/
+RUN for plugin in $(ls /opt/cni/bin); do \
+        strip /opt/cni/bin/${plugin}; \
+    done
+
 
 # Create image with the cni-plugins
 FROM ${BCI_IMAGE}
-COPY --from=cni_plugins /opt/cni/ /opt/cni/
+COPY --from=strip_binary /opt/cni/ /opt/cni/
 WORKDIR /
 COPY install-cnis.sh .
 ENTRYPOINT ["./install-cnis.sh"]

Makefile

@@ -14,36 +14,36 @@ BUILD_META=-build$(shell date +%Y%m%d)
 ORG ?= rancher
 TAG ?= v1.4.1$(BUILD_META)
 
-ifneq ($(DRONE_TAG),)
-	TAG := $(DRONE_TAG)
-endif
-
 ifeq (,$(filter %$(BUILD_META),$(TAG)))
-	$(error TAG needs to end with build metadata: $(BUILD_META))
+(error TAG $(TAG) needs to end with build metadata: $(BUILD_META))
 endif
 
 .PHONY: image-build
 image-build:
-	docker build \
+	docker buildx build \
 		--pull \
+		--platform=$(ARCH) \
 		--build-arg ARCH=$(ARCH) \
 		--build-arg TAG=$(TAG:$(BUILD_META)=) \
 		--tag $(ORG)/hardened-cni-plugins:$(TAG) \
 		--tag $(ORG)/hardened-cni-plugins:$(TAG)-$(ARCH) \
+		--load \
 	.
 
 .PHONY: image-push
 image-push:
 	docker push $(ORG)/hardened-cni-plugins:$(TAG)-$(ARCH)
 
-.PHONY: image-manifest
-image-manifest:
-	DOCKER_CLI_EXPERIMENTAL=enabled docker manifest create --amend \
-		$(ORG)/hardened-cni-plugins:$(TAG) \
-		$(ORG)/hardened-cni-plugins:$(TAG)-$(ARCH)
-	DOCKER_CLI_EXPERIMENTAL=enabled docker manifest push \
-		$(ORG)/hardened-cni-plugins:$(TAG)
-
 .PHONY: image-scan
 image-scan:
 	trivy image --severity $(SEVERITIES) --no-progress --ignore-unfixed $(ORG)/hardened-cni-plugins:$(TAG)
+
+.PHONY: log
+log:
+	@echo "ARCH=$(ARCH)"
+	@echo "TAG=$(TAG)"
+	@echo "ORG=$(ORG)"
+	@echo "PKG=$(PKG)"
+	@echo "SRC=$(SRC)"
+	@echo "BUILD_META=$(BUILD_META)"
+	@echo "UNAME_M=$(UNAME_M)"