mirror of
https://github.com/moby/buildkit.git
synced 2026-08-06 07:40:49 +00:00
251 lines
8.3 KiB
YAML
251 lines
8.3 KiB
YAML
name: frontend
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches:
|
|
- 'master'
|
|
- 'v[0-9]+.[0-9]+'
|
|
tags:
|
|
- 'dockerfile/*'
|
|
pull_request:
|
|
paths-ignore:
|
|
- 'README.md'
|
|
- 'docs/**'
|
|
- 'frontend/dockerfile/docs/**'
|
|
|
|
env:
|
|
GO_VERSION: "1.26"
|
|
SETUP_BUILDX_VERSION: "edge"
|
|
SETUP_BUILDKIT_TAG: "moby/buildkit:latest"
|
|
SCOUT_VERSION: "1.20.2"
|
|
IMAGE_NAME: "docker/dockerfile-upstream"
|
|
|
|
jobs:
|
|
test:
|
|
uses: ./.github/workflows/.test.yml
|
|
with:
|
|
cache_scope: frontend-integration-tests
|
|
pkgs: ./frontend/dockerfile
|
|
kinds: |
|
|
integration
|
|
dockerfile
|
|
codecov_flags: dockerfile-frontend
|
|
secrets:
|
|
codecov_token: ${{ secrets.CODECOV_TOKEN }}
|
|
|
|
prepare:
|
|
runs-on: ubuntu-24.04
|
|
outputs:
|
|
includes: ${{ steps.set.outputs.includes }}
|
|
tag: ${{ steps.set.outputs.tag }}
|
|
steps:
|
|
-
|
|
name: Set outputs
|
|
id: set
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
|
|
env:
|
|
INPUT_REF: ${{ github.ref }}
|
|
INPUT_CHANNELS: |
|
|
mainline
|
|
labs
|
|
INPUT_IMAGE-NAME: ${{ env.IMAGE_NAME }}
|
|
with:
|
|
script: |
|
|
const ref = core.getInput('ref');
|
|
const channels = core.getMultilineInput('channels');
|
|
const imageName = core.getInput('image-name');
|
|
|
|
function getTags(channel) {
|
|
let tagSuffix = '';
|
|
if (channel !== 'mainline') {
|
|
tagSuffix = `-${channel}`;
|
|
}
|
|
let tagLatest = '';
|
|
let tagVersion = '';
|
|
if (ref.startsWith('refs/tags/dockerfile/')) {
|
|
const version = ref.replace('refs/tags/dockerfile/', '').replace(new RegExp(`-${channel}$`), '');
|
|
if (/^[0-9]+\.[0-9]+\.[0-9]+$/.test(version)) {
|
|
tagLatest = channel === 'mainline' ? 'latest' : channel;
|
|
}
|
|
tagVersion = version;
|
|
}
|
|
return { tagSuffix, tagLatest, tagVersion };
|
|
}
|
|
|
|
const matrix = [];
|
|
if (ref.startsWith('refs/tags/dockerfile/')) {
|
|
const version = ref.replace('refs/tags/dockerfile/', '');
|
|
for (const channel of channels) {
|
|
if (version.endsWith(`-${channel}`)) {
|
|
const { tagSuffix, tagLatest, tagVersion } = getTags(channel);
|
|
matrix.push({
|
|
channel: channel,
|
|
imageName: imageName,
|
|
tagSuffix: tagSuffix,
|
|
tagLatest: tagLatest,
|
|
tagVersion: tagVersion
|
|
});
|
|
break;
|
|
}
|
|
}
|
|
if (matrix.length === 0) {
|
|
// default to mainline if no channel suffix
|
|
const { tagSuffix, tagLatest, tagVersion } = getTags('mainline');
|
|
matrix.push({
|
|
channel: 'mainline',
|
|
imageName: imageName,
|
|
tagSuffix: tagSuffix,
|
|
tagLatest: tagLatest,
|
|
tagVersion: tagVersion
|
|
});
|
|
}
|
|
core.setOutput('tag', ref.replace('refs/tags/', ''));
|
|
} else {
|
|
for (const channel of channels) {
|
|
const { tagSuffix, tagLatest, tagVersion } = getTags(channel);
|
|
matrix.push({
|
|
channel: channel,
|
|
imageName: imageName,
|
|
tagSuffix: tagSuffix,
|
|
tagLatest: tagLatest,
|
|
tagVersion: tagVersion
|
|
});
|
|
}
|
|
}
|
|
|
|
core.info(JSON.stringify(matrix, null, 2));
|
|
core.setOutput('includes', JSON.stringify(matrix));
|
|
|
|
image:
|
|
uses: docker/github-builder/.github/workflows/bake.yml@a492c6d04fd3315f67230809b44d60cc0acd50b3 # v1.16.0
|
|
needs:
|
|
- prepare
|
|
- test
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include: ${{ fromJson(needs.prepare.outputs.includes) }}
|
|
permissions:
|
|
contents: read # same as global permission
|
|
id-token: write # for signing attestations, cache entries and logging in to Docker Hub with GitHub OIDC
|
|
with:
|
|
runner: ubuntu-24.04
|
|
target: frontend-image-cross
|
|
cache: true
|
|
cache-scope: frontend-${{ matrix.channel }}
|
|
output: image
|
|
push: ${{ github.repository == 'moby/buildkit' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/dockerfile/')) }}
|
|
sbom: true
|
|
vars: |
|
|
FRONTEND_CHANNEL=${{ matrix.channel }}
|
|
set-meta-annotations: true
|
|
meta-images: |
|
|
${{ matrix.imageName }}
|
|
# versioning strategy
|
|
## push tag dockerfile/1.17.0
|
|
### docker/dockerfile-upstream:1.17.0
|
|
### docker/dockerfile-upstream:1.17
|
|
### docker/dockerfile-upstream:1
|
|
### docker/dockerfile-upstream:latest
|
|
## push tag dockerfile/1.17.0-labs
|
|
### docker/dockerfile-upstream:1.17.0-labs
|
|
### docker/dockerfile-upstream:1.17-labs
|
|
### docker/dockerfile-upstream:1-labs
|
|
### docker/dockerfile-upstream:labs
|
|
## push prerelease tag dockerfile/1.17.0-rc1
|
|
### docker/dockerfile-upstream:1.17.0-rc1
|
|
## push prerelease tag dockerfile/1.17.0-rc1-labs
|
|
### docker/dockerfile-upstream:1.17.0-rc1-labs
|
|
## push on master
|
|
### docker/dockerfile-upstream:master
|
|
### docker/dockerfile-upstream:master-labs
|
|
meta-tags: |
|
|
type=ref,event=branch,suffix=${{ matrix.tagSuffix }}
|
|
type=ref,event=pr,suffix=${{ matrix.tagSuffix }}
|
|
type=semver,pattern={{version}},value=${{ matrix.tagVersion }},suffix=${{ matrix.tagSuffix }}
|
|
type=semver,pattern={{major}}.{{minor}},value=${{ matrix.tagVersion }},suffix=${{ matrix.tagSuffix }}
|
|
type=semver,pattern={{major}},value=${{ matrix.tagVersion }},suffix=${{ matrix.tagSuffix }}
|
|
type=raw,value=${{ matrix.tagLatest }}
|
|
meta-flavor: |
|
|
latest=false
|
|
meta-annotations: |
|
|
org.opencontainers.image.title=Dockerfile Frontend
|
|
org.opencontainers.image.vendor=Moby
|
|
meta-bake-target: frontend-meta-helper
|
|
registry-identities: |
|
|
- type: dockerhub
|
|
registry: docker.io
|
|
username: docker
|
|
connection_id: ${{ vars.DOCKERFILE_OIDC_CONNECTIONID }}
|
|
|
|
scout:
|
|
runs-on: ubuntu-24.04
|
|
if: ${{ github.repository == 'moby/buildkit' && github.ref == 'refs/heads/master' }}
|
|
permissions:
|
|
contents: read # same as global permission
|
|
security-events: write # required to write sarif report
|
|
needs:
|
|
- image
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
tag:
|
|
- master
|
|
- master-labs
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
-
|
|
# FIXME: switch to OIDC once Scout supports it
|
|
name: Login to DockerHub
|
|
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
-
|
|
name: Scout
|
|
id: scout
|
|
uses: crazy-max/.github/.github/actions/docker-scout@46267a6e61cd56aac2fc79943df180152f4c89d6 # v1.10.1
|
|
with:
|
|
version: ${{ env.SCOUT_VERSION }}
|
|
format: sarif
|
|
image: registry://${{ env.IMAGE_NAME }}:${{ matrix.tag }}
|
|
-
|
|
name: Result output
|
|
run: |
|
|
jq . ${{ steps.scout.outputs.result-file }}
|
|
-
|
|
name: Upload SARIF report
|
|
uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
|
|
with:
|
|
sarif_file: ${{ steps.scout.outputs.result-file }}
|
|
|
|
release:
|
|
runs-on: ubuntu-24.04
|
|
if: startsWith(github.ref, 'refs/tags/dockerfile')
|
|
permissions:
|
|
# required to create GitHub release
|
|
contents: write
|
|
needs:
|
|
- prepare
|
|
- test
|
|
- image
|
|
steps:
|
|
-
|
|
name: GitHub Release
|
|
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
with:
|
|
draft: true
|
|
name: ${{ needs.prepare.outputs.tag }}
|