chore(main): release 0.3.1 (#252) #211
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: | |
| - main | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_PREFIX: ghcr.io/${{ github.repository_owner }} | |
| jobs: | |
| release-please: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| environment: release | |
| permissions: | |
| contents: write | |
| issues: write | |
| pull-requests: write | |
| outputs: | |
| new-release-created: ${{ steps.release-please-action.outputs.releases_created }} | |
| tag-name: ${{ steps.release-please-action.outputs.tag_name }} | |
| steps: | |
| - name: Generate GitHub App token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.APP_ID }} | |
| private-key: ${{ secrets.APP_PRIVATE_KEY }} | |
| permission-contents: write | |
| permission-pull-requests: write | |
| - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0 | |
| id: release-please-action | |
| with: | |
| release-type: go | |
| token: ${{ steps.app-token.outputs.token }} | |
| build: | |
| name: Build ${{ matrix.name }} Image | |
| needs: release-please | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 40 | |
| permissions: | |
| contents: read | |
| packages: write | |
| attestations: write | |
| id-token: write | |
| artifact-metadata: write | |
| strategy: | |
| matrix: | |
| include: | |
| - name: hub | |
| base_image: gcr.io/distroless/base-nossl-debian13:nonroot | |
| - name: agent | |
| base_image: gcr.io/distroless/base-nossl-debian13:latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| - name: Verify distroless base image signature | |
| run: | | |
| cosign verify \ | |
| ${{ matrix.base_image }} \ | |
| --certificate-oidc-issuer https://accounts.google.com \ | |
| --certificate-identity keyless@distroless.iam.gserviceaccount.com | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Set build date | |
| id: build_date | |
| run: echo "value=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> "$GITHUB_OUTPUT" | |
| - name: Extract metadata for ${{ matrix.name }} | |
| id: meta | |
| uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 | |
| with: | |
| images: ${{ env.IMAGE_PREFIX }}/${{ matrix.name }} | |
| tags: | | |
| type=semver,pattern={{version}},value=${{ needs.release-please.outputs.tag-name }},enable=${{ needs.release-please.outputs.new-release-created == 'true' }} | |
| type=semver,pattern={{major}}.{{minor}}.{{patch}},value=${{ needs.release-please.outputs.tag-name }},enable=${{ needs.release-please.outputs.new-release-created == 'true' }} | |
| type=semver,pattern={{major}}.{{minor}},value=${{ needs.release-please.outputs.tag-name }},enable=${{ needs.release-please.outputs.new-release-created == 'true' }} | |
| type=semver,pattern={{major}},value=${{ needs.release-please.outputs.tag-name }},enable=${{ needs.release-please.outputs.new-release-created == 'true' }} | |
| type=raw,value=latest,enable=${{ needs.release-please.outputs.new-release-created == 'true' }} | |
| type=raw,value=main | |
| - name: Build and push ${{ matrix.name }} image | |
| id: build | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| context: . | |
| file: ${{ matrix.name }}.Dockerfile | |
| push: true | |
| platforms: linux/amd64,linux/arm64 | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| annotations: ${{ steps.meta.outputs.annotations }} | |
| build-args: | | |
| VERSION=${{ needs.release-please.outputs.new-release-created == 'true' && needs.release-please.outputs.tag-name || 'main' }} | |
| COMMIT=${{ github.sha }} | |
| BUILD_DATE=${{ steps.build_date.outputs.value }} | |
| cache-from: type=gha | |
| cache-to: type=gha | |
| provenance: mode=max | |
| sbom: true | |
| - name: Attest ${{ matrix.name }} image | |
| uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1 | |
| with: | |
| subject-name: ${{ env.IMAGE_PREFIX }}/${{ matrix.name }} | |
| subject-digest: ${{ steps.build.outputs.digest }} | |
| push-to-registry: true | |
| - name: Sign ${{ matrix.name }} image | |
| env: | |
| DIGEST: ${{ steps.build.outputs.digest }} | |
| run: | | |
| LOWERCASE_IMAGE_PREFIX=$(echo "$IMAGE_PREFIX" | tr '[:upper:]' '[:lower:]') | |
| cosign sign --yes \ | |
| "$LOWERCASE_IMAGE_PREFIX/${{ matrix.name }}@$DIGEST" |