Sign

.github/actions/install-dct-key/action.yml

@@ -0,0 +1,22 @@
+name: Install DCT Key
+description: Installs a key file to use with DCT into the local DCT store.
+
+inputs:
+  key-id:
+    description: 'The ID of the key'
+    required: true
+  key-content:
+    description: 'The content of the key'
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Install DCT key
+      shell: bash
+      run: |
+        DELEGATION_KEY_FILE="$HOME/.docker/trust/private/${{ inputs.key-id }}.key"
+        mkdir -p $(dirname "$DELEGATION_KEY_FILE")
+        touch "$DELEGATION_KEY_FILE"
+        chmod 600 "$DELEGATION_KEY_FILE"
+        echo "${{ inputs.key-content }}" > "$DELEGATION_KEY_FILE"

.github/workflows/dct_pull_cd_preprod.yml

@@ -0,0 +1,61 @@
+name: "CD: dct_pull (pre-prod)"
+
+on:
+  push:
+    branches:
+      - 'deploy-dct-pull-preprod'
+
+env:
+  TAG_VERSION: "v0-preprod"
+  STAGING_DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-executor-staging"
+  DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-executor"
+  DIST_VERSION_PREFIX: "executor-preprod"
+  DOCKER_CONTENT_TRUST: 1
+  DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: ${{ secrets.DOCKERHUB_DELEGATED_KEY_PASS }}
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Install DCT key
+        uses: ./.github/actions/install-dct-key
+        with:
+          key-id: "${{ secrets.DOCKERHUB_DELEGATED_KEY_ID }}"
+          key-content: "${{ secrets.DOCKERHUB_DELEGATED_KEY }}"
+
+      - name: Promote image
+        run: |
+          IMAGE_NAME="${DOCKER_REPO_NAME}:${TAG_VERSION}"
+          SHA_IMAGE_NAME="${STAGING_DOCKER_REPO_NAME}:git-${GITHUB_SHA}"
+
+          docker pull "${SHA_IMAGE_NAME}"
+          docker image tag "${SHA_IMAGE_NAME}" "${IMAGE_NAME}"
+
+          echo "${{ secrets.DOCKERHUB_KEY }}" | docker login -u "${{ secrets.DOCKERHUB_USERNAME }}" --password-stdin
+
+          docker push "${IMAGE_NAME}"
+
+      - name: Get current date
+        id: date
+        run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
+
+      - name: Set Dist Version
+        run: |
+          BUILD_NUMBER="${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}"
+          echo "DIST_VERSION=${DIST_VERSION_PREFIX}-${{ steps.date.outputs.date }}-${BUILD_NUMBER}" >> $GITHUB_ENV
+
+      - name: Create Tag
+        uses: actions/github-script@v6
+        with:
+          script: |
+            const {DIST_VERSION} = process.env
+            github.rest.git.createRef({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                ref: `refs/tags/${DIST_VERSION}`,
+                sha: context.sha
+            })

.github/workflows/dct_pull_cd_prod.yml

@@ -0,0 +1,61 @@
+name: "CD: dct_pull (prod)"
+
+on:
+  push:
+    branches:
+      - 'deploy-dct-pull-prod'
+
+env:
+  TAG_VERSION: "v0-latest"
+  STAGING_DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-dct-pull-staging"
+  DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-dct-pull"
+  DIST_VERSION_PREFIX: "dct-pull-prod"
+  DOCKER_CONTENT_TRUST: 1
+  DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: ${{ secrets.DOCKERHUB_DELEGATED_KEY_PASS }}
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Install DCT key
+        uses: ./.github/actions/install-dct-key
+        with:
+          key-id: "${{ secrets.DOCKERHUB_DELEGATED_KEY_ID }}"
+          key-content: "${{ secrets.DOCKERHUB_DELEGATED_KEY }}"
+
+      - name: Promote image
+        run: |
+          IMAGE_NAME="${DOCKER_REPO_NAME}:${TAG_VERSION}"
+          SHA_IMAGE_NAME="${STAGING_DOCKER_REPO_NAME}:git-${GITHUB_SHA}"
+
+          docker pull "${SHA_IMAGE_NAME}"
+          docker image tag "${SHA_IMAGE_NAME}" "${IMAGE_NAME}"
+
+          echo "${{ secrets.DOCKERHUB_KEY }}" | docker login -u "${{ secrets.DOCKERHUB_USERNAME }}" --password-stdin
+
+          docker push "${IMAGE_NAME}"
+
+      - name: Get current date
+        id: date
+        run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
+
+      - name: Set Dist Version
+        run: |
+          BUILD_NUMBER="${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}"
+          echo "DIST_VERSION=${DIST_VERSION_PREFIX}-${{ steps.date.outputs.date }}-${BUILD_NUMBER}" >> $GITHUB_ENV
+
+      - name: Create Tag
+        uses: actions/github-script@v6
+        with:
+          script: |
+            const {DIST_VERSION} = process.env
+            github.rest.git.createRef({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                ref: `refs/tags/${DIST_VERSION}`,
+                sha: context.sha
+            })

.github/workflows/dct_pull_cd_staging.yml

@@ -0,0 +1,63 @@
+name: "CD: dct_pull (staging)"
+
+on:
+  push:
+    branches:
+      - 'deploy-dct-pull-staging'
+
+env:
+  TAG_VERSION: "v0-latest"
+  BUILD_DIRECTORY: "dct_pull"
+  DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-dct-pull-staging"
+  DIST_VERSION_PREFIX: "dct-pull-staging"
+  DOCKER_CONTENT_TRUST: 1
+  DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: ${{ secrets.DOCKERHUB_DELEGATED_KEY_PASS }}
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Install DCT key
+        uses: ./.github/actions/install-dct-key
+        with:
+          key-id: "${{ secrets.DOCKERHUB_DELEGATED_KEY_ID }}"
+          key-content: "${{ secrets.DOCKERHUB_DELEGATED_KEY }}"
+
+      - name: Docker build, sign and push
+        run: |
+          IMAGE_NAME="${DOCKER_REPO_NAME}:${TAG_VERSION}"
+          SHA_IMAGE_NAME="${DOCKER_REPO_NAME}:git-${GITHUB_SHA}"
+
+          cd "${BUILD_DIRECTORY}" && docker build --build-context compute-horde=../compute_horde -t "${IMAGE_NAME}" -f app/envs/prod/Dockerfile .
+
+          docker image tag "${IMAGE_NAME}" "${SHA_IMAGE_NAME}"
+
+          echo "${{ secrets.DOCKERHUB_KEY }}" | docker login -u "${{ secrets.DOCKERHUB_USERNAME }}" --password-stdin
+
+          docker push "${IMAGE_NAME}"
+          docker push "${SHA_IMAGE_NAME}"
+
+      - name: Get current date
+        id: date
+        run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
+
+      - name: Set Dist Version
+        run: |
+          BUILD_NUMBER="${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}"
+          echo "DIST_VERSION=${DIST_VERSION_PREFIX}-${{ steps.date.outputs.date }}-${BUILD_NUMBER}" >> $GITHUB_ENV
+
+      - name: Create Tag
+        uses: actions/github-script@v6
+        with:
+          script: |
+            const {DIST_VERSION} = process.env
+            github.rest.git.createRef({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                ref: `refs/tags/${DIST_VERSION}`,
+                sha: context.sha
+            })

.github/workflows/executor_cd_preprod.yml

@@ -10,6 +10,8 @@ env:
   STAGING_DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-executor-staging"
   DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-executor"
   DIST_VERSION_PREFIX: "executor-preprod"
+  DOCKER_CONTENT_TRUST: 1
+  DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: ${{ secrets.DOCKERHUB_DELEGATED_KEY_PASS }}
 
 jobs:
   deploy:
@@ -18,7 +20,14 @@ jobs:
       - uses: actions/checkout@v2
         with:
           fetch-depth: 0
-      - name: Docker build and push
+
+      - name: Install DCT key
+        uses: ./.github/actions/install-dct-key
+        with:
+          key-id: "${{ secrets.DOCKERHUB_DELEGATED_KEY_ID }}"
+          key-content: "${{ secrets.DOCKERHUB_DELEGATED_KEY }}"
+
+      - name: Promote image
         run: |
           IMAGE_NAME="${DOCKER_REPO_NAME}:${TAG_VERSION}"
           SHA_IMAGE_NAME="${STAGING_DOCKER_REPO_NAME}:git-${GITHUB_SHA}"
@@ -29,13 +38,16 @@ jobs:
           echo "${{ secrets.DOCKERHUB_KEY }}" | docker login -u "${{ secrets.DOCKERHUB_USERNAME }}" --password-stdin
 
           docker push "${IMAGE_NAME}"
+
       - name: Get current date
         id: date
         run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
+
       - name: Set Dist Version
         run: |
           BUILD_NUMBER="${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}"
           echo "DIST_VERSION=${DIST_VERSION_PREFIX}-${{ steps.date.outputs.date }}-${BUILD_NUMBER}" >> $GITHUB_ENV
+
       - name: Create Tag
         uses: actions/github-script@v6
         with:

.github/workflows/executor_cd_prod.yml

@@ -10,6 +10,8 @@ env:
   STAGING_DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-executor-staging"
   DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-executor"
   DIST_VERSION_PREFIX: "executor-prod"
+  DOCKER_CONTENT_TRUST: 1
+  DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: ${{ secrets.DOCKERHUB_DELEGATED_KEY_PASS }}
 
 jobs:
   deploy:
@@ -18,7 +20,14 @@ jobs:
       - uses: actions/checkout@v2
         with:
           fetch-depth: 0
-      - name: Docker build and push
+
+      - name: Install DCT key
+        uses: ./.github/actions/install-dct-key
+        with:
+          key-id: "${{ secrets.DOCKERHUB_DELEGATED_KEY_ID }}"
+          key-content: "${{ secrets.DOCKERHUB_DELEGATED_KEY }}"
+
+      - name: Promote image
         run: |
           IMAGE_NAME="${DOCKER_REPO_NAME}:${TAG_VERSION}"
           SHA_IMAGE_NAME="${STAGING_DOCKER_REPO_NAME}:git-${GITHUB_SHA}"
@@ -29,13 +38,16 @@ jobs:
           echo "${{ secrets.DOCKERHUB_KEY }}" | docker login -u "${{ secrets.DOCKERHUB_USERNAME }}" --password-stdin
 
           docker push "${IMAGE_NAME}"
+
       - name: Get current date
         id: date
         run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
+
       - name: Set Dist Version
         run: |
           BUILD_NUMBER="${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}"
           echo "DIST_VERSION=${DIST_VERSION_PREFIX}-${{ steps.date.outputs.date }}-${BUILD_NUMBER}" >> $GITHUB_ENV
+
       - name: Create Tag
         uses: actions/github-script@v6
         with:

.github/workflows/executor_cd_staging.yml

@@ -10,6 +10,8 @@ env:
   TAG_VERSION: "v0-latest"
   DOCKER_REPO_NAME: "backenddevelopersltd/compute-horde-executor-staging"
   DIST_VERSION_PREFIX: "executor-staging"
+  DOCKER_CONTENT_TRUST: 1
+  DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE: ${{ secrets.DOCKERHUB_DELEGATED_KEY_PASS }}
 
 jobs:
   deploy:
@@ -18,7 +20,14 @@ jobs:
       - uses: actions/checkout@v2
         with:
           fetch-depth: 0
-      - name: Docker build and push
+
+      - name: Install DCT key
+        uses: ./.github/actions/install-dct-key
+        with:
+          key-id: "${{ secrets.DOCKERHUB_DELEGATED_KEY_ID }}"
+          key-content: "${{ secrets.DOCKERHUB_DELEGATED_KEY }}"
+
+      - name: Docker build, sign and push
         run: |
           IMAGE_NAME="${DOCKER_REPO_NAME}:${TAG_VERSION}"
           SHA_IMAGE_NAME="${DOCKER_REPO_NAME}:git-${GITHUB_SHA}"
@@ -31,13 +40,16 @@ jobs:
 
           docker push "${IMAGE_NAME}"
           docker push "${SHA_IMAGE_NAME}"
+
       - name: Get current date
         id: date
         run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
+
       - name: Set Dist Version
         run: |
           BUILD_NUMBER="${{ github.run_id }}-${{ github.run_number }}-${{ github.run_attempt }}"
           echo "DIST_VERSION=${DIST_VERSION_PREFIX}-${{ steps.date.outputs.date }}-${BUILD_NUMBER}" >> $GITHUB_ENV
+
       - name: Create Tag
         uses: actions/github-script@v6
         with: