constellation/.github/actions/build_micro_service/action.yml
Fabian Kammel 18ae86c38e
sbom signing (#303)
Signed-off-by: Fabian Kammel <fk@edgeless.systems>
2022-10-21 15:19:51 +02:00

77 lines
2.6 KiB
YAML

name: Build micro service
description: Build and upload a container image for a Constellation micro-service
inputs:
name:
description: "Name of the micro-service"
required: true
projectVersion:
description: "Version of the micro-service"
default: "0.0.0"
required: false
dockerfile:
description: "Path to the services Dockerfile"
required: true
pushTag:
description: "Use this image tag"
required: false
githubToken:
description: "GitHub authorization token"
required: true
cosignPublicKey:
description: "Cosign public key"
required: false
cosignPrivateKey:
description: "Cosign private key"
required: false
cosignPassword:
description: "Password for Cosign private key"
required: false
# Linux runner only (Docker required)
runs:
using: "composite"
steps:
- name: Determine pseudo version
id: pseudo-version
uses: ./.github/actions/pseudo_version
- name: Docker metadata
id: meta
uses: docker/metadata-action@57396166ad8aefe6098280995947635806a0e6ea # tag=v4.1.1
with:
images: |
ghcr.io/${{ github.repository }}/${{ inputs.name }}
tags: |
type=raw,value=latest,enable={{is_default_branch}}
type=raw,value=${{ inputs.pushTag }},enable=${{ '' != inputs.pushTag }}
type=raw,value=${{ steps.pseudo-version.outputs.pseudoVersion }},enable=${{ '' != steps.pseudo-version.outputs.pseudoVersion }}
type=ref,event=branch
- name: Log in to the Container registry
id: docker-login
uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # tag=v2.1.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ inputs.githubToken }}
- name: Build and push container image
id: build-micro-service
uses: docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5 # tag=v3.2.0
with:
context: .
file: ${{ inputs.dockerfile }}
target: release
push: true
tags: ${{ steps.meta.outputs.tags }}
build-args: |
PROJECT_VERSION=${{ inputs.projectVersion }}
- name: Generate SBOM
uses: ./.github/actions/container_sbom
with:
containerReference: ghcr.io/${{ github.repository }}/${{ inputs.name }}@${{ steps.build-micro-service.outputs.digest }}
cosignPublicKey: ${{ inputs.cosignPublicKey }}
cosignPrivateKey: ${{ inputs.cosignPrivateKey }}
cosignPassword: ${{ inputs.cosignPassword }}
if: ${{ inputs.cosignPublicKey != '' && inputs.cosignPrivateKey != '' && inputs.cosignPassword != '' }}