Update component versions (#71) #116
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Some of this (well most) is copied from https://github.com/scikit-hep/pyhf/blob/4ecbf49/.github/workflows/docker.yml | |
| name: Docker Images | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| docker: | |
| name: Build, test, and publish Docker images to Docker Hub | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write # push images to ghcr.io | |
| outputs: | |
| digest: ${{ steps.build-and-push.outputs.digest }} | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository_owner }}/actions-runner | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Load current versions | |
| id: versions | |
| uses: falti/dotenv-action@fff81fa3263fb96221c521b5e526e57c0c56d760 # v1.2.1 | |
| with: | |
| log-variables: true | |
| export-variables: true | |
| keys-case: "upper" | |
| - name: Docker meta | |
| id: meta | |
| uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 | |
| with: | |
| images: | | |
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| # generate Docker tags based on the following events/attributes | |
| tags: | | |
| type=edge,branch=main | |
| type=sha,format=short | |
| type=ref,event=pr | |
| type=raw,value=latest | |
| type=raw,value=${{ env.RUNNER_VERSION }}-latest | |
| type=raw,value=${{ env.RUNNER_VERSION }}-${{ env.RUNNER_CONTAINER_HOOKS_VERSION }} | |
| # needed to load multi-arch images | |
| - name: Set up Docker | |
| uses: docker/setup-docker-action@77e84dbf09b47d1e29270283c22f16145aa85ca1 # v5.4.0 | |
| with: | |
| daemon-config: | | |
| { | |
| "debug": true, | |
| "features": { | |
| "containerd-snapshotter": true | |
| } | |
| } | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 | |
| - name: Login to CERN GitLab | |
| if: | |
| github.event_name != 'pull_request' && github.repository == | |
| 'usatlas/runner' | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| registry: gitlab-registry.cern.ch | |
| username: ${{ secrets.GITLAB_REGISTRY_USERNAME }} | |
| password: ${{ secrets.GITLAB_REGISTRY_TOKEN }} | |
| - name: Login to GitHub Container Registry | |
| if: | |
| github.event_name != 'pull_request' && github.repository == | |
| 'usatlas/runner' | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push | |
| id: build-and-push | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| context: . | |
| file: images/Dockerfile | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| build-args: | | |
| RUNNER_VERSION=${{ env.RUNNER_VERSION }} | |
| RUNNER_CONTAINER_HOOKS_VERSION=${{ env.RUNNER_CONTAINER_HOOKS_VERSION }} | |
| platforms: linux/amd64,linux/arm64 | |
| load: true | |
| push: | |
| ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| && github.repository == 'usatlas/runner' }} | |
| # https://github.com/orgs/community/discussions/45969#discussioncomment-13352049 | |
| provenance: false # Disable provenance to avoid unknown/unknown | |
| sbom: false # Disable sbom to avoid unknown/unknown | |
| - name: Image digest | |
| run: echo "$DIGEST" | |
| env: | |
| DIGEST: ${{ steps.build-only.outputs.digest }} | |
| - name: List built images | |
| run: docker images | |
| attest: | |
| name: Generate build provenance attestation | |
| needs: docker | |
| runs-on: ubuntu-latest | |
| # every PR will trigger a push event on main, so check the push event is actually coming from main | |
| if: | |
| github.event_name == 'push' && github.ref == 'refs/heads/main' && | |
| github.repository == 'usatlas/runner' | |
| permissions: | |
| id-token: write # sign build provenance attestations | |
| attestations: write # publish build provenance attestations | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository_owner }}/actions-runner | |
| steps: | |
| - name: Generate attestation | |
| continue-on-error: true # https://github.com/usatlas/runner/issues/6 | |
| uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 | |
| with: | |
| subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| subject-digest: ${{ needs.docker.outputs.digest }} | |
| push-to-registry: true |