Use securebuild melange and apko specs

.github/actions/build-securebuild-image-locally/action.yml

@@ -0,0 +1,43 @@
+name: Build a SecureBuild image locally
+description: Publish an image locally from a SecureBuild APKO spec and local Melange packages
+
+inputs:
+  config:
+    description: Path to the SecureBuild APKO config
+    required: true
+  image-name:
+    description: Full destination image name
+    required: true
+  registry-username:
+    description: Username used to log in to the registry
+    default: ''
+    required: false
+  registry-password:
+    description: Password used to log in to the registry
+    default: ''
+    required: false
+
+runs:
+  using: composite
+  steps:
+    - uses: actions/download-artifact@v8
+      with:
+        pattern: securebuild-melange-packages-*
+        path: ./packages/
+        merge-multiple: true
+
+    - uses: actions/download-artifact@v8
+      with:
+        pattern: securebuild-melange-rsa-pub-*
+        merge-multiple: true
+
+    - uses: chainguard-images/actions/apko-publish@v1.0.37
+      with:
+        config: ${{ inputs.config }}
+        archs: amd64,arm64
+        tag: ${{ inputs.image-name }}
+        repository-append: ./packages
+        keyring-append: ./melange-amd64.rsa.pub,./melange-arm64.rsa.pub
+        vcs-url: true
+        generic-user: ${{ inputs.registry-username }}
+        generic-pass: ${{ inputs.registry-password }}

.github/actions/build-securebuild-package-locally/action.yml

@@ -0,0 +1,76 @@
+name: Build the SecureBuild package locally
+description: Build the SecureBuild Melange spec locally for prerelease versions
+
+inputs:
+  git-tag:
+    description: Version tag to embed in the binaries
+    required: true
+  arch:
+    description: Architecture to build for
+    required: true
+  source-ref:
+    description: Exact source commit used for package provenance; defaults to the workflow commit
+    required: false
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - name: Configure packages for arm64
+      if: inputs.arch == 'arm64'
+      shell: bash
+      run: |
+        sudo apt-get update -y
+        sudo apt-get install -y curl jq gettext-base pkg-config apparmor
+        # ARC container runners don't run systemd as PID 1, so 'systemctl reload apparmor'
+        # (called by setup-melange) fails. Shim it to use apparmor_parser directly.
+        sudo tee /usr/local/bin/systemctl > /dev/null << 'SHIM'
+        #!/bin/bash
+        if [[ "$1" == "reload" && "$2" == "apparmor" ]]; then
+          apparmor_parser -r /etc/apparmor.d/ 2>/dev/null || true
+          exit 0
+        fi
+        exec /usr/bin/systemctl "$@"
+        SHIM
+        sudo chmod +x /usr/local/bin/systemctl
+
+    - uses: chainguard-dev/actions/setup-melange@v1.6.30
+
+    - name: Build packages
+      shell: bash
+      env:
+        ARCH: ${{ inputs.arch }}
+        GIT_TAG: ${{ inputs.git-tag }}
+        SOURCE_REF: ${{ inputs.source-ref || github.sha }}
+      run: |
+        env_file="$RUNNER_TEMP/melange.env"
+        signing_key="$RUNNER_TEMP/melange-${ARCH}.rsa"
+
+        # SecureBuild replaces the package version when it runs the spec. Melange cannot
+        # use our prerelease version as an APK version, so retain the spec's valid placeholder.
+        # The local git-checkout pipeline override keeps the source already populated from
+        # actions/checkout instead of cloning the release tag referenced by the unchanged spec.
+        printf 'export GIT_TAG=%q\nexport VERSION=%q\n' "$GIT_TAG" "$GIT_TAG" > "$env_file"
+
+        sudo melange keygen "$signing_key"
+        sudo melange build securebuild/package/melange.yaml \
+          --arch "$ARCH" \
+          --env-file "$env_file" \
+          --git-commit "$SOURCE_REF" \
+          --git-repo-url "${{ github.server_url }}/${{ github.repository }}" \
+          --out-dir "$GITHUB_WORKSPACE/packages" \
+          --pipeline-dir "${{ github.action_path }}/pipelines" \
+          --signing-key "$signing_key" \
+          --source-dir "$GITHUB_WORKSPACE"
+        sudo cp "$signing_key.pub" "$GITHUB_WORKSPACE/melange-${ARCH}.rsa.pub"
+        sudo chown -R "$(id -u):$(id -g)" "$GITHUB_WORKSPACE/packages" "$GITHUB_WORKSPACE/melange-${ARCH}.rsa.pub"
+
+    - uses: actions/upload-artifact@v7
+      with:
+        name: securebuild-melange-packages-${{ inputs.arch }}
+        path: ./packages
+
+    - uses: actions/upload-artifact@v7
+      with:
+        name: securebuild-melange-rsa-pub-${{ inputs.arch }}
+        path: ./melange-${{ inputs.arch }}.rsa.pub

.github/actions/build-securebuild-package-locally/pipelines/git-checkout.yaml

@@ -0,0 +1,12 @@
+name: Use source from the local workspace
+
+inputs:
+  repository:
+    description: Unused; the repository has already been checked out by the workflow
+    required: true
+  tag:
+    description: Unused; the workflow checkout determines the source revision
+
+pipeline:
+  - runs: |
+      echo "Using source already checked out by the workflow"

.github/workflows/alpha.yaml

@@ -19,7 +19,7 @@ jobs:
         uses: ./.github/actions/version-tag
 
 
-  build-migrations-melange-packages:
+  build-melange-packages:
     needs: [generate-tag]
     strategy:
       fail-fast: true
@@ -31,91 +31,43 @@ jobs:
     runs-on: ${{ matrix.runner.name }}
     steps:
       - uses: actions/checkout@v7
-      - uses: ./.github/actions/build-custom-melange-package
+      - uses: ./.github/actions/build-securebuild-package-locally
         with:
-          context: migrations/deploy
-          component: kotsadm-migrations
           git-tag: ${{ needs.generate-tag.outputs.tag }}
           arch: ${{ matrix.runner.arch }}
 
   build-migrations:
     runs-on: ubuntu-latest
-    needs: [generate-tag, build-migrations-melange-packages]
+    needs: [generate-tag, build-melange-packages]
     steps:
       - uses: actions/checkout@v7
-      - uses: ./.github/actions/build-custom-image-with-apko
+      - uses: ./.github/actions/build-securebuild-image-locally
         with:
-          context: migrations/deploy
-          component: kotsadm-migrations
-          git-tag: ${{ needs.generate-tag.outputs.tag }}
+          config: securebuild/image/apko-kotsadm-migrations.yaml
           image-name: index.docker.io/kotsadm/kotsadm-migrations:alpha
           registry-username: ${{ secrets.DOCKERHUB_USER }}
           registry-password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
-
-  build-kotsadm-melange-packages:
-    needs: [generate-tag]
-    strategy:
-      fail-fast: true
-      matrix:
-        runner: [
-          {name: ubuntu-latest, arch: amd64},
-          {name: arm64-runner-set, arch: arm64}
-        ]
-    runs-on: ${{ matrix.runner.name }}
-    steps:
-      - uses: actions/checkout@v7
-      - uses: ./.github/actions/build-custom-melange-package
-        with:
-          context: deploy
-          component: kotsadm
-          git-tag: ${{ needs.generate-tag.outputs.tag }}
-          arch: ${{ matrix.runner.arch }}
-
   build-kotsadm:
     runs-on: ubuntu-latest
-    needs: [generate-tag, build-kotsadm-melange-packages]
+    needs: [generate-tag, build-melange-packages]
     steps:
       - uses: actions/checkout@v7
-      - uses: ./.github/actions/build-custom-image-with-apko
+      - uses: ./.github/actions/build-securebuild-image-locally
         with:
-          context: deploy
-          component: kotsadm
-          git-tag: ${{ needs.generate-tag.outputs.tag }}
+          config: securebuild/image/apko-kotsadm.yaml
           image-name: index.docker.io/kotsadm/kotsadm:alpha
           registry-username: ${{ secrets.DOCKERHUB_USER }}
           registry-password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
-
-  build-kurl-proxy-melange-packages:
-    needs: [generate-tag]
-    strategy:
-      fail-fast: true
-      matrix:
-        runner: [
-          {name: ubuntu-latest, arch: amd64},
-          {name: arm64-runner-set, arch: arm64}
-        ]
-    runs-on: ${{ matrix.runner.name }}
-    steps:
-      - uses: actions/checkout@v7
-      - uses: ./.github/actions/build-custom-melange-package
-        with:
-          context: kurl_proxy/deploy
-          component: kurl-proxy
-          git-tag: ${{ needs.generate-tag.outputs.tag }}
-          arch: ${{ matrix.runner.arch }}
-
   build-kurl-proxy:
     runs-on: ubuntu-latest
-    needs: [generate-tag, build-kurl-proxy-melange-packages]
+    needs: [generate-tag, build-melange-packages]
     steps:
       - uses: actions/checkout@v7
-      - uses: ./.github/actions/build-custom-image-with-apko
+      - uses: ./.github/actions/build-securebuild-image-locally
         with:
-          context: kurl_proxy/deploy
-          component: kurl-proxy
-          git-tag: ${{ needs.generate-tag.outputs.tag }}
+          config: securebuild/image/apko-kurl-proxy.yaml
           image-name: index.docker.io/kotsadm/kurl-proxy:alpha
           registry-username: ${{ secrets.DOCKERHUB_USER }}
           registry-password: ${{ secrets.DOCKERHUB_PASSWORD }}
@@ -330,4 +282,3 @@ jobs:
         uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: kotsadm-migration-scan-output.sarif
-