cloudflare-ddns/.github/workflows/build.yaml at 254b54f76d1d892ab88950dd9dc83e834e6836ae · favonia/cloudflare-ddns · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
name: Build

on:
  push:
    branches:
      - main
  pull_request:
  release:
    types: [published]

env:
  platforms: "linux/386,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/amd64,linux/ppc64le,linux/riscv64,linux/s390x"

permissions:
  contents: read

jobs:
  docker:
    name: Docker image
    runs-on: ubuntu-latest
    concurrency:
      group: ${{ github.workflow }}-build-${{ github.ref }}
      cancel-in-progress: true
    permissions:
      id-token: write # for cosign keyless signing via GitHub OIDC
      contents: read
      packages: write # for pushing images and signatures to GitHub Container Registry
    steps:
      - name: 🛡️ Harden Runner
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit
          disable-sudo: true
          policy: docker-build-publish-sign

      - name: 🚚 Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: 🤖 Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
      - name: 🏗️ Set up Docker Buildx
        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
        with:
          version: latest
          cache-binary: false
      - name: 🔑 Log in to Docker
        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        if: ${{ github.event_name != 'pull_request' }}
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      - name: 🔑 Log in to GitHub Container Registry
        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
        if: ${{ github.event_name != 'pull_request' }}
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: 🏷️ Fetch git tags for `git describe`
        run: "git fetch --force --prune --unshallow --tags"
      - name: 📝 Run `git describe` and save its output
        run: echo "GIT_DESCRIBE=$(git describe --tags --always --long)" >> "$GITHUB_OUTPUT"
        id: git-describe
      - name: 📝 Calculate metadata for minimal Docker images
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        id: meta
        with:
          images: |
            ${{ github.repository }}
            ghcr.io/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}
            type=edge
          annotations: |
            io.artifacthub.package.license=Apache-2.0 WITH LLVM-exception
            io.artifacthub.package.readme-url=https://raw.githubusercontent.com/favonia/cloudflare-ddns/main/build/SUMMARY.markdown
            io.artifacthub.package.maintainers=[{"name":"favonia","email":"favonia@email.com"}]
        env:
          DOCKER_METADATA_ANNOTATIONS_LEVELS: index
      - name: 🚀 Build and deploy minimal Docker images
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        id: build
        with:
          target: "minimal"
          push: ${{ github.event_name != 'pull_request' }}
          build-args: |
            ${{ format('GIT_DESCRIBE={0}', steps.git-describe.outputs.GIT_DESCRIBE) }}
          platforms: ${{ env.platforms }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          annotations: ${{ steps.meta.outputs.annotations }}
          provenance: "mode=max"
      - name: 🔎 Verify minimal image mirrors
        if: ${{ github.event_name != 'pull_request' }}
        run: |
          docker buildx imagetools inspect "docker.io/favonia/cloudflare-ddns@${STEPS_BUILD_OUTPUTS_DIGEST}"
          docker buildx imagetools inspect "ghcr.io/favonia/cloudflare-ddns@${STEPS_BUILD_OUTPUTS_DIGEST}"
        env:
          STEPS_BUILD_OUTPUTS_DIGEST: ${{ steps.build.outputs.digest }}
      - name: ✍️ Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
      - name: ✍️ Sign the minimal Docker images
        if: ${{ github.event_name == 'release' }}
        run: |
          cosign sign --recursive --yes \
            "docker.io/favonia/cloudflare-ddns@${STEPS_BUILD_OUTPUTS_DIGEST}" \
            "ghcr.io/favonia/cloudflare-ddns@${STEPS_BUILD_OUTPUTS_DIGEST}"
        env:
          STEPS_BUILD_OUTPUTS_DIGEST: ${{ steps.build.outputs.digest }}
      - name: 🔎 Verify the signed minimal Docker images
        if: ${{ github.event_name == 'release' }}
        run: |
          cosign verify \
            --certificate-identity "https://github.com/${GITHUB_REPOSITORY}/.github/workflows/build.yaml@${GITHUB_REF}" \
            --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
            "docker.io/favonia/cloudflare-ddns@${STEPS_BUILD_OUTPUTS_DIGEST}" \
            "ghcr.io/favonia/cloudflare-ddns@${STEPS_BUILD_OUTPUTS_DIGEST}"
        env:
          STEPS_BUILD_OUTPUTS_DIGEST: ${{ steps.build.outputs.digest }}

      - name: 📝 Calculate metadata for Docker images with alpine
        if: ${{ github.event_name != 'release' }}
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        id: meta-alpine
        with:
          images: |
            ${{ github.repository }}
            ghcr.io/${{ github.repository }}
          tags: |
            type=edge,suffix=-alpine
          annotations: |
            io.artifacthub.package.license=Apache-2.0 WITH LLVM-exception
            io.artifacthub.package.readme-url=https://raw.githubusercontent.com/favonia/cloudflare-ddns/main/build/SUMMARY.markdown
            io.artifacthub.package.maintainers=[{"name":"favonia","email":"favonia@email.com"}]
        env:
          DOCKER_METADATA_ANNOTATIONS_LEVELS: index
      - name: 🚀 Build and deploy Docker images with alpine
        if: ${{ github.event_name != 'release' }}
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        id: build-alpine
        with:
          target: "alpine"
          push: ${{ github.event_name != 'pull_request' }}
          build-args: |
            ${{ format('GIT_DESCRIBE={0}', steps.git-describe.outputs.GIT_DESCRIBE) }}
          platforms: ${{ env.platforms }}
          tags: ${{ steps.meta-alpine.outputs.tags }}
          labels: ${{ steps.meta-alpine.outputs.labels }}
          annotations: ${{ steps.meta-alpine.outputs.annotations }}
          provenance: "mode=max"
      - name: 🔎 Verify alpine image mirrors
        if: ${{ github.event_name != 'pull_request' && github.event_name != 'release' }}
        run: |
          docker buildx imagetools inspect "docker.io/favonia/cloudflare-ddns@${STEPS_BUILD_ALPINE_OUTPUTS_DIGEST}"
          docker buildx imagetools inspect "ghcr.io/favonia/cloudflare-ddns@${STEPS_BUILD_ALPINE_OUTPUTS_DIGEST}"
        env:
          STEPS_BUILD_ALPINE_OUTPUTS_DIGEST: ${{ steps.build-alpine.outputs.digest }}