Merge pull request #224 from pjbgf/prime

Publish Prime images using ecm-distro-tools GHA
rancher · Jul 31, 2024 · d720221 · d720221
2 parents a80b9eb + f9e81b3
commit d720221
Show file tree

Hide file tree

Showing 3 changed files with 46 additions and 26 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -5,39 +5,58 @@ on:
     tags:
       - 'v*'
 
-permissions:
-  contents: read
-  id-token: write # required by read-vault-secrets
-
 jobs:
 
-  publish-public:
+  publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # write is needed for:
+      # - OIDC for cosign's use in ecm-distro-tools/publish-image.
+      # - Read vault secrets in rancher-eio/read-vault-secrets.
+      id-token: write
 
+    strategy:
+      matrix:
+        include:
+          # Three images are created:
+          # - Multi-arch manifest for both amd64 and arm64
+          - tag-suffix: ""
+            platforms: linux/amd64,linux/arm64
+          # - arm64 manifest
+          - tag-suffix: "-arm64"
+            platforms: linux/arm64
+          # - amd64 manifest
+          - tag-suffix: "-amd64"
+            platforms: linux/amd64
+
     steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
     - name: Load Secrets from Vault
       uses: rancher-eio/read-vault-secrets@main
       with:
         secrets: |
           secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials username | DOCKER_USERNAME ;
           secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials password | DOCKER_PASSWORD
-    - name: Login to Docker Hub
-      uses: docker/login-action@v3
-      with:
-        username: ${{ env.DOCKER_USERNAME }}
-        password: ${{ env.DOCKER_PASSWORD }}
-    - name: Setup QEMU
-      uses: docker/setup-qemu-action@v3
-    - name: Setup Docker Buildx
-      uses: docker/setup-buildx-action@v3
-    - name: Checkout code
-      uses: actions/checkout@v4
+          secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials registry | PRIME_REGISTRY ;
+          secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials username | PRIME_REGISTRY_USERNAME ;
+          secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials password | PRIME_REGISTRY_PASSWORD ;
+
+      - name: Publish manifest
+        uses: rancher/ecm-distro-tools/actions/publish-image@master
+        with:
+          image: security-scan
+          tag: ${{ github.ref_name }}${{ matrix.tag-suffix }}
+          platforms: ${{ matrix.platforms }}
+
+          public-registry: docker.io
+          public-repo: rancher
+          public-username: ${{ env.DOCKERHUB_USERNAME }}
+          public-password: ${{ env.DOCKERHUB_TOKEN }}
+
+          prime-registry: ${{ env.PRIME_REGISTRY }}
+          prime-repo: rancher
+          prime-username: ${{ env.PRIME_REGISTRY_USERNAME }}
+          prime-password: ${{ env.PRIME_REGISTRY_PASSWORD }}
 
-    - name: Build and push all image variations
-      run: |
-        make image-push
-        TAG="${TAG}-amd64" TARGET_PLATFORMS=linux/amd64 make image-push
-        TAG="${TAG}-arm64" TARGET_PLATFORMS=linux/arm64 make image-push
-      env:
-        TAG: ${{ github.ref_name }}
-        REPO: ${{ vars.PUBLIC_REGISTRY }}/${{ vars.PUBLIC_REGISTRY_REPO }}
diff --git a/Makefile b/Makefile
@@ -43,8 +43,8 @@ image-build: buildx-machine ## build (and load) the container image targeting th
 		--build-arg VERSION=$(VERSION) -t "$(IMAGE)" $(BUILD_ACTION) .
 	@echo "Built $(IMAGE)"
 
-.PHONY: image-push
-image-push: buildx-machine ## build the container image targeting all platforms defined by TARGET_PLATFORMS and push to a registry.
+.PHONY: push-image
+push-image: buildx-machine ## build the container image targeting all platforms defined by TARGET_PLATFORMS and push to a registry.
 	$(IMAGE_BUILDER) build -f package/Dockerfile \
 		--builder $(MACHINE) $(IMAGE_ARGS) $(IID_FILE_FLAG) $(BUILDX_ARGS) \
 		--build-arg VERSION=$(VERSION) --platform=$(TARGET_PLATFORMS) -t "$(IMAGE)" --push .

diff --git a/hack/make/build.mk b/hack/make/build.mk
@@ -36,6 +36,7 @@ endif
 RUNNER := docker
 IMAGE_BUILDER := $(RUNNER) buildx
 MACHINE := rancher
+BUILDX_ARGS ?= --sbom=true --attest type=provenance,mode=max
 
 ifeq ($(TAG),)
 	TAG = $(VERSION)