Image Security Updates #139
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Image Security Updates | |
| on: | |
| schedule: | |
| - cron: "0 4 * * 1" | |
| workflow_dispatch: | |
| inputs: | |
| immutable: | |
| type: boolean | |
| description: Generate stable image tags | |
| buildkitVersion: | |
| type: string | |
| description: Override version defined in Helm chart | |
| jobs: | |
| process-input: | |
| name: Process input | |
| runs-on: ubuntu-latest | |
| outputs: | |
| buildkit_src_tag: ${{ steps.image_tags.outputs.buildkit_src_tag }} | |
| buildkit_dst_tag: ${{ steps.image_tags.outputs.buildkit_dst_tag }} | |
| buildkit_rootless_src_tag: ${{ steps.image_tags.outputs.buildkit_rootless_src_tag }} | |
| buildkit_rootless_dst_tag: ${{ steps.image_tags.outputs.buildkit_rootless_dst_tag }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Validate user input | |
| if: github.event.inputs.buildkitVersion != '' | |
| run: curl --head --fail https://hub.docker.com/v2/repositories/moby/buildkit/tags/${{ inputs.buildkitVersion }} | |
| - id: buildkit_tag | |
| name: Extract image tag from Helm values | |
| uses: mikefarah/yq@v4.43.1 | |
| with: | |
| cmd: test -n "${{ inputs.buildkitVersion }}" && echo "${{ inputs.buildkitVersion }}" || yq '.buildkit.image.tag' deployments/helm/hephaestus/values.yaml | sed 's/-rootless//' | |
| - id: image_tags | |
| name: Construct image tags | |
| run: | | |
| IMMUTABLE_SUFFIX="$([[ "${{ inputs.immutable }}" == "true" ]] && echo "-$(date +%Y%m%d%H%M%S)" || echo "")" | |
| BUILDKIT_INPUT_TAG="${{ steps.buildkit_tag.outputs.result }}" | |
| BUILDKIT_OUTPUT_TAG="$BUILDKIT_INPUT_TAG$IMMUTABLE_SUFFIX" | |
| BUILDKIT_ROOTLESS_INPUT_TAG="$BUILDKIT_INPUT_TAG-rootless" | |
| BUILDKIT_ROOTLESS_OUTPUT_TAG="$BUILDKIT_ROOTLESS_INPUT_TAG$IMMUTABLE_SUFFIX" | |
| echo "buildkit_src_tag=$BUILDKIT_INPUT_TAG" >> $GITHUB_OUTPUT | |
| echo "buildkit_dst_tag=$BUILDKIT_OUTPUT_TAG" >> $GITHUB_OUTPUT | |
| echo "buildkit_rootless_src_tag=$BUILDKIT_ROOTLESS_INPUT_TAG" >> $GITHUB_OUTPUT | |
| echo "buildkit_rootless_dst_tag=$BUILDKIT_ROOTLESS_OUTPUT_TAG" >> $GITHUB_OUTPUT | |
| buildkit: | |
| name: Buildkit | |
| runs-on: ubuntu-latest | |
| needs: [process-input] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Login to container registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: quay.io | |
| username: ${{ secrets.QUAY_USERNAME }} | |
| password: ${{ secrets.QUAY_PASSWORD }} | |
| - name: Build and push image to Quay | |
| uses: docker/build-push-action@v5 | |
| with: | |
| push: true | |
| target: root | |
| context: build/buildkit | |
| build-args: BUILDKIT_TAG=${{ needs.process-input.outputs.buildkit_src_tag }} | |
| tags: quay.io/domino/buildkit:${{ needs.process-input.outputs.buildkit_dst_tag }} | |
| buildkit-rootless: | |
| name: Buildkit Rootless | |
| runs-on: ubuntu-latest | |
| needs: [process-input] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Login to container registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: quay.io | |
| username: ${{ secrets.QUAY_USERNAME }} | |
| password: ${{ secrets.QUAY_PASSWORD }} | |
| - name: Build and push image to Quay | |
| uses: docker/build-push-action@v5 | |
| with: | |
| push: true | |
| target: rootless | |
| context: build/buildkit | |
| build-args: BUILDKIT_TAG=${{ needs.process-input.outputs.buildkit_rootless_src_tag }} | |
| tags: quay.io/domino/buildkit:${{ needs.process-input.outputs.buildkit_rootless_dst_tag }} |