-
Notifications
You must be signed in to change notification settings - Fork 13
113 lines (100 loc) · 4.09 KB
/
build_CI.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
###############################################################################
# _ _ _ _ _____ _
# | | | | | | | | | __ \(_)
# | | ___ | |__ _ __ | |_| |__ ___ | |__) |_ _ __ _ __ ___ _ __
# _ | |/ _ \| '_ \| '_ \ | __| '_ \ / _ \ | _ /| | '_ \| '_ \ / _ \ '__|
# | |__| | (_) | | | | | | | | |_| | | | __/ | | \ \| | |_) | |_) | __/ |
# \____/ \___/|_| |_|_| |_| \__|_| |_|\___| |_| \_\_| .__/| .__/ \___|_|
# | | | |
# |_| |_|
#
# Copyright (c) 2024 Claudio André <[email protected]>
#
# This program comes with ABSOLUTELY NO WARRANTY; express or implied.
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, as expressed in version 2, seen at
# http://www.gnu.org/licenses/gpl-2.0.html
###############################################################################
---
name: CI Docker image
"on":
push:
branches: [images]
workflow_dispatch:
env:
REPO: ghcr.io/${{ github.repository_owner }}/john-ci
permissions: read-all
jobs:
build:
name: Build image
runs-on: ubuntu-latest
continue-on-error: true
strategy:
matrix:
include:
- image-tag: fedora.latest
dockerfile: Dockerfile.FedoraLatest
- image-tag: fedora.flatpak
dockerfile: Dockerfile.flatpak.package
- image-tag: ubuntu.opencl
dockerfile: Dockerfile.OpenCL
- image-tag: ubuntu.devel
dockerfile: Dockerfile.UbuntuDevel
- image-tag: ubuntu.rolling
dockerfile: Dockerfile.UbuntuRolling
- image-tag: redhat.ubi8
dockerfile: Dockerfile.RHUbi8
permissions:
packages: write
contents: read
outputs:
image: ${{ steps.image.outputs.image }}
digest: ${{ steps.build-and-push.outputs.digest }}
steps:
- name: Harden Runner
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
with:
egress-policy: audit
- name: Check out the repo
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: Log in to GitHub Docker Registry
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Build container image
id: build-and-push
uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
with:
push: true
file: "${{ github.workspace }}/CI/Dockerfiles/${{ matrix.dockerfile }}"
tags: |
${{ env.REPO }}:${{ matrix.image-tag }}
${{ env.REPO }}:${{ matrix.image-tag }}J${{ github.run_number }}
outputs: "type=image,name=target,\
annotation-index.org.opencontainers.image.authors=Claudio André <[email protected]>,\
annotation-index.org.opencontainers.image.description=John the Ripper CI"
- name: Output image
id: image
run: |
image_name="${{ env.REPO }}:${{ matrix.image-tag }}"
echo "The image is $image_name"
echo "image=$image_name" >> "$GITHUB_OUTPUT"
# It's unclear whether provenance can work with a matrix of Docker images
provenance:
if: ${{ false }}
needs: [build]
permissions:
actions: read # for detecting the GitHub Actions environment.
id-token: write # for creating OIDC tokens for signing.
packages: write # for uploading attestations.
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
with:
image: ${{ needs.build.outputs.image }}
digest: ${{ needs.build.outputs.digest }}
registry-username: ${{ github.actor }}
secrets:
registry-password: ${{ secrets.GITHUB_TOKEN }}