Skip to content

Commit b932e3b

Browse files
divolgindivolgin
authored
Use securebuild melange and apko specs (#6021)
1 parent e5e4c13 commit b932e3b

17 files changed

Lines changed: 227 additions & 625 deletions

File tree

‎.github/actions/build-custom-image-with-apko/action.yml‎

Lines changed: 0 additions & 57 deletions
This file was deleted.

‎.github/actions/build-custom-melange-package/action.yml‎

Lines changed: 0 additions & 68 deletions
This file was deleted.

‎.github/actions/build-securebuild-image-locally/action.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: Build a SecureBuild image locally
2+
description: Publish an image locally from a SecureBuild APKO spec and local Melange packages
3+
4+
inputs:
5+
config:
6+
description: Path to the SecureBuild APKO config
7+
required: true
8+
image-name:
9+
description: Full destination image name
10+
required: true
11+
registry-username:
12+
description: Username used to log in to the registry
13+
default: ''
14+
required: false
15+
registry-password:
16+
description: Password used to log in to the registry
17+
default: ''
18+
required: false
19+
20+
runs:
21+
using: composite
22+
steps:
23+
- uses: actions/download-artifact@v8
24+
with:
25+
pattern: securebuild-melange-packages-*
26+
path: ./packages/
27+
merge-multiple: true
28+
29+
- uses: actions/download-artifact@v8
30+
with:
31+
pattern: securebuild-melange-rsa-pub-*
32+
merge-multiple: true
33+
34+
- uses: chainguard-images/actions/apko-publish@v1.0.37
35+
with:
36+
config: ${{ inputs.config }}
37+
archs: amd64,arm64
38+
tag: ${{ inputs.image-name }}
39+
repository-append: ./packages
40+
keyring-append: ./melange-amd64.rsa.pub,./melange-arm64.rsa.pub
41+
vcs-url: true
42+
generic-user: ${{ inputs.registry-username }}
43+
generic-pass: ${{ inputs.registry-password }}

‎.github/actions/build-securebuild-package-locally/action.yml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
name: Build the SecureBuild package locally
2+
description: Build the SecureBuild Melange spec locally for prerelease versions
3+
4+
inputs:
5+
git-tag:
6+
description: Version tag to embed in the binaries
7+
required: true
8+
arch:
9+
description: Architecture to build for
10+
required: true
11+
source-ref:
12+
description: Exact source commit used for package provenance; defaults to the workflow commit
13+
required: false
14+
default: ''
15+
16+
runs:
17+
using: composite
18+
steps:
19+
- name: Configure packages for arm64
20+
if: inputs.arch == 'arm64'
21+
shell: bash
22+
run: |
23+
sudo apt-get update -y
24+
sudo apt-get install -y curl jq gettext-base pkg-config apparmor
25+
# ARC container runners don't run systemd as PID 1, so 'systemctl reload apparmor'
26+
# (called by setup-melange) fails. Shim it to use apparmor_parser directly.
27+
sudo tee /usr/local/bin/systemctl > /dev/null << 'SHIM'
28+
#!/bin/bash
29+
if [[ "$1" == "reload" && "$2" == "apparmor" ]]; then
30+
apparmor_parser -r /etc/apparmor.d/ 2>/dev/null || true
31+
exit 0
32+
fi
33+
exec /usr/bin/systemctl "$@"
34+
SHIM
35+
sudo chmod +x /usr/local/bin/systemctl
36+
37+
- uses: chainguard-dev/actions/setup-melange@v1.6.30
38+
39+
- name: Build packages
40+
shell: bash
41+
env:
42+
ARCH: ${{ inputs.arch }}
43+
GIT_TAG: ${{ inputs.git-tag }}
44+
SOURCE_REF: ${{ inputs.source-ref || github.sha }}
45+
run: |
46+
env_file="$RUNNER_TEMP/melange.env"
47+
signing_key="$RUNNER_TEMP/melange-${ARCH}.rsa"
48+
49+
# SecureBuild replaces the package version when it runs the spec. Melange cannot
50+
# use our prerelease version as an APK version, so retain the spec's valid placeholder.
51+
# The local git-checkout pipeline override keeps the source already populated from
52+
# actions/checkout instead of cloning the release tag referenced by the unchanged spec.
53+
printf 'export GIT_TAG=%q\nexport VERSION=%q\n' "$GIT_TAG" "$GIT_TAG" > "$env_file"
54+
55+
sudo melange keygen "$signing_key"
56+
sudo melange build securebuild/package/melange.yaml \
57+
--arch "$ARCH" \
58+
--env-file "$env_file" \
59+
--git-commit "$SOURCE_REF" \
60+
--git-repo-url "${{ github.server_url }}/${{ github.repository }}" \
61+
--out-dir "$GITHUB_WORKSPACE/packages" \
62+
--pipeline-dir "${{ github.action_path }}/pipelines" \
63+
--signing-key "$signing_key" \
64+
--source-dir "$GITHUB_WORKSPACE"
65+
sudo cp "$signing_key.pub" "$GITHUB_WORKSPACE/melange-${ARCH}.rsa.pub"
66+
sudo chown -R "$(id -u):$(id -g)" "$GITHUB_WORKSPACE/packages" "$GITHUB_WORKSPACE/melange-${ARCH}.rsa.pub"
67+
68+
- uses: actions/upload-artifact@v7
69+
with:
70+
name: securebuild-melange-packages-${{ inputs.arch }}
71+
path: ./packages
72+
73+
- uses: actions/upload-artifact@v7
74+
with:
75+
name: securebuild-melange-rsa-pub-${{ inputs.arch }}
76+
path: ./melange-${{ inputs.arch }}.rsa.pub

‎.github/actions/build-securebuild-package-locally/pipelines/git-checkout.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: Use source from the local workspace
2+
3+
inputs:
4+
repository:
5+
description: Unused; the repository has already been checked out by the workflow
6+
required: true
7+
tag:
8+
description: Unused; the workflow checkout determines the source revision
9+
10+
pipeline:
11+
- runs: |
12+
echo "Using source already checked out by the workflow"

‎.github/workflows/alpha.yaml‎

Lines changed: 11 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
uses: ./.github/actions/version-tag
2020

2121

22-
build-migrations-melange-packages:
22+
build-melange-packages:
2323
needs: [generate-tag]
2424
strategy:
2525
fail-fast: true
@@ -31,91 +31,43 @@ jobs:
3131
runs-on: ${{ matrix.runner.name }}
3232
steps:
3333
- uses: actions/checkout@v7
34-
- uses: ./.github/actions/build-custom-melange-package
34+
- uses: ./.github/actions/build-securebuild-package-locally
3535
with:
36-
context: migrations/deploy
37-
component: kotsadm-migrations
3836
git-tag: ${{ needs.generate-tag.outputs.tag }}
3937
arch: ${{ matrix.runner.arch }}
4038

4139
build-migrations:
4240
runs-on: ubuntu-latest
43-
needs: [generate-tag, build-migrations-melange-packages]
41+
needs: [generate-tag, build-melange-packages]
4442
steps:
4543
- uses: actions/checkout@v7
46-
- uses: ./.github/actions/build-custom-image-with-apko
44+
- uses: ./.github/actions/build-securebuild-image-locally
4745
with:
48-
context: migrations/deploy
49-
component: kotsadm-migrations
50-
git-tag: ${{ needs.generate-tag.outputs.tag }}
46+
config: securebuild/image/apko-kotsadm-migrations.yaml
5147
image-name: index.docker.io/kotsadm/kotsadm-migrations:alpha
5248
registry-username: ${{ secrets.DOCKERHUB_USER }}
5349
registry-password: ${{ secrets.DOCKERHUB_PASSWORD }}
5450

55-
56-
build-kotsadm-melange-packages:
57-
needs: [generate-tag]
58-
strategy:
59-
fail-fast: true
60-
matrix:
61-
runner: [
62-
{name: ubuntu-latest, arch: amd64},
63-
{name: arm64-runner-set, arch: arm64}
64-
]
65-
runs-on: ${{ matrix.runner.name }}
66-
steps:
67-
- uses: actions/checkout@v7
68-
- uses: ./.github/actions/build-custom-melange-package
69-
with:
70-
context: deploy
71-
component: kotsadm
72-
git-tag: ${{ needs.generate-tag.outputs.tag }}
73-
arch: ${{ matrix.runner.arch }}
74-
7551
build-kotsadm:
7652
runs-on: ubuntu-latest
77-
needs: [generate-tag, build-kotsadm-melange-packages]
53+
needs: [generate-tag, build-melange-packages]
7854
steps:
7955
- uses: actions/checkout@v7
80-
- uses: ./.github/actions/build-custom-image-with-apko
56+
- uses: ./.github/actions/build-securebuild-image-locally
8157
with:
82-
context: deploy
83-
component: kotsadm
84-
git-tag: ${{ needs.generate-tag.outputs.tag }}
58+
config: securebuild/image/apko-kotsadm.yaml
8559
image-name: index.docker.io/kotsadm/kotsadm:alpha
8660
registry-username: ${{ secrets.DOCKERHUB_USER }}
8761
registry-password: ${{ secrets.DOCKERHUB_PASSWORD }}
8862

89-
90-
build-kurl-proxy-melange-packages:
91-
needs: [generate-tag]
92-
strategy:
93-
fail-fast: true
94-
matrix:
95-
runner: [
96-
{name: ubuntu-latest, arch: amd64},
97-
{name: arm64-runner-set, arch: arm64}
98-
]
99-
runs-on: ${{ matrix.runner.name }}
100-
steps:
101-
- uses: actions/checkout@v7
102-
- uses: ./.github/actions/build-custom-melange-package
103-
with:
104-
context: kurl_proxy/deploy
105-
component: kurl-proxy
106-
git-tag: ${{ needs.generate-tag.outputs.tag }}
107-
arch: ${{ matrix.runner.arch }}
108-
10963
build-kurl-proxy:
11064
runs-on: ubuntu-latest
111-
needs: [generate-tag, build-kurl-proxy-melange-packages]
65+
needs: [generate-tag, build-melange-packages]
11266
steps:
11367
- uses: actions/checkout@v7
114-
- uses: ./.github/actions/build-custom-image-with-apko
68+
- uses: ./.github/actions/build-securebuild-image-locally
11569
with:
116-
context: kurl_proxy/deploy
117-
component: kurl-proxy
118-
git-tag: ${{ needs.generate-tag.outputs.tag }}
70+
config: securebuild/image/apko-kurl-proxy.yaml
11971
image-name: index.docker.io/kotsadm/kurl-proxy:alpha
12072
registry-username: ${{ secrets.DOCKERHUB_USER }}
12173
registry-password: ${{ secrets.DOCKERHUB_PASSWORD }}
@@ -330,4 +282,3 @@ jobs:
330282
uses: github/codeql-action/upload-sarif@v4
331283
with:
332284
sarif_file: kotsadm-migration-scan-output.sarif
333-

0 commit comments

Comments
 (0)