From cf06453e8845e30d68796ea7f8403f48284539ab Mon Sep 17 00:00:00 2001 From: Thomas Ferrandiz Date: Wed, 13 Mar 2024 10:25:29 +0000 Subject: [PATCH] Migrate to github actions Signed-off-by: Thomas Ferrandiz --- .drone.yml | 143 --------------------- .github/workflows/build.yml | 70 ++++++++++ .github/workflows/image-push.yml | 34 +++++ Makefile | 32 ++--- manifest-coredns.tmpl | 12 -- updatecli/updatecli.d/updatebuildbase.yaml | 10 -- 6 files changed, 118 insertions(+), 183 deletions(-) delete mode 100644 .drone.yml create mode 100644 .github/workflows/build.yml create mode 100644 .github/workflows/image-push.yml delete mode 100644 manifest-coredns.tmpl diff --git a/.drone.yml b/.drone.yml deleted file mode 100644 index 613d464..0000000 --- a/.drone.yml +++ /dev/null @@ -1,143 +0,0 @@ ---- -kind: pipeline -type: docker -name: linux-amd64 - -platform: - os: linux - arch: amd64 - -steps: -- name: build - pull: always - image: rancher/hardened-build-base:v1.21.8b1 - commands: - - make DRONE_TAG=${DRONE_TAG} image-build - volumes: - - name: docker - path: /var/run/docker.sock - when: - ref: - include: - - refs/heads/master - - refs/pull/** - - refs/tags/* - -- name: publish - image: rancher/hardened-build-base:v1.21.8b1 - commands: - - docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD - - make DRONE_TAG=${DRONE_TAG} image-push - environment: - DOCKER_PASSWORD: - from_secret: docker_password - DOCKER_USERNAME: - from_secret: docker_username - volumes: - - name: docker - path: /var/run/docker.sock - when: - event: - - tag - -- name: scan - image: rancher/hardened-build-base:v1.21.8b1 - commands: - - make DRONE_TAG=${DRONE_TAG} image-scan - volumes: - - name: docker - path: /var/run/docker.sock - when: - ref: - include: - - refs/heads/master - - refs/pull/** - - refs/tags/* - -volumes: -- name: docker - host: - path: /var/run/docker.sock ---- -kind: pipeline -type: docker -name: linux-arm64 - -platform: - os: linux - arch: arm64 - -steps: -- name: build - pull: always - image: rancher/hardened-build-base:v1.21.8b1 - commands: - - make DRONE_TAG=${DRONE_TAG} image-build - volumes: - - name: docker - path: /var/run/docker.sock - when: - ref: - include: - - refs/heads/master - - refs/pull/** - - refs/tags/* - -- name: publish - image: rancher/hardened-build-base:v1.21.8b1 - commands: - - docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD - - make DRONE_TAG=${DRONE_TAG} image-push - environment: - DOCKER_PASSWORD: - from_secret: docker_password - DOCKER_USERNAME: - from_secret: docker_username - volumes: - - name: docker - path: /var/run/docker.sock - when: - event: - - tag - -- name: scan - image: rancher/hardened-build-base:v1.21.8b1 - commands: - - make DRONE_TAG=${DRONE_TAG} image-scan - volumes: - - name: docker - path: /var/run/docker.sock - when: - ref: - include: - - refs/heads/master - - refs/pull/** - - refs/tags/* - -volumes: -- name: docker - host: - path: /var/run/docker.sock ---- -kind: pipeline -type: docker -name: manifest-coredns -platform: - os: linux - arch: amd64 -steps: -- name: push - image: plugins/manifest:1.2.3 - settings: - password: - from_secret: docker_password - username: - from_secret: docker_username - spec: manifest-coredns.tmpl - ignore_missing: true - when: - event: - - tag -depends_on: -- linux-amd64 -- linux-arm64 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml new file mode 100644 index 0000000..472f1fb --- /dev/null +++ b/.github/workflows/build.yml @@ -0,0 +1,70 @@ +on: + push: + branches: + - master + pull_request: + +permissions: + contents: read + security-events: write # upload Sarif results + +name: Build +jobs: + build-amd64: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Set the TAG value + id: get-TAG + run: | + echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV" + - name: Build container image + uses: docker/build-push-action@v5 + with: + context: . + push: false + tags: rancher/hardened-coredns:${{ env.TAG }}-amd64 + file: Dockerfile + + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@0.18.0 + with: + image-ref: rancher/hardened-coredns:${{ env.TAG }}-amd64 + ignore-unfixed: true + vuln-type: 'os,library' + severity: 'CRITICAL,HIGH' + format: 'sarif' + output: 'trivy-results.sarif' + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v3 + if: always() + with: + sarif_file: 'trivy-results.sarif' + + build-arm64: + runs-on: ubuntu-latest + steps: + - name: Check out code + uses: actions/checkout@v4 + + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Set the TAG value + id: get-TAG + run: | + echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV" + - name: Build container image + uses: docker/build-push-action@v5 + with: + context: . + push: false + tags: rancher/hardened-coredns:${{ env.TAG }}-arm64 + file: Dockerfile + outputs: type=docker + platforms: linux/arm64 diff --git a/.github/workflows/image-push.yml b/.github/workflows/image-push.yml new file mode 100644 index 0000000..f65dcad --- /dev/null +++ b/.github/workflows/image-push.yml @@ -0,0 +1,34 @@ +on: + release: + types: [published] + +permissions: + contents: read + +jobs: + push-multiarch: + runs-on: ubuntu-latest + steps: + - name: Check out code + uses: actions/checkout@v4 + + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Login to Container Registry + uses: docker/login-action@v3 + with: + username: ${{ secrets.docker_username }} + password: ${{ secrets.docker_password }} + + - name: Build container image + uses: docker/build-push-action@v5 + with: + context: . + push: true + tags: rancher/hardened-coredns:${{ github.event.release.tag_name }} + file: Dockerfile + platforms: linux/amd64, linux/arm64 diff --git a/Makefile b/Makefile index a3b728f..73e41ce 100644 --- a/Makefile +++ b/Makefile @@ -17,18 +17,14 @@ SRC ?= github.com/coredns/coredns TAG ?= v1.11.1$(BUILD_META) export DOCKER_BUILDKIT?=1 -ifneq ($(DRONE_TAG),) - TAG := $(DRONE_TAG) -endif - ifeq (,$(filter %$(BUILD_META),$(TAG))) - $(error TAG needs to end with build metadata: $(BUILD_META)) + $(error TAG ${TAG} needs to end with build metadata: $(BUILD_META)) endif .PHONY: image-build image-build: - docker build \ - --pull \ + docker buildx build \ + --platform=$(ARCH) \ --build-arg PKG=$(PKG) \ --build-arg SRC=$(SRC) \ --build-arg TAG=$(TAG:$(BUILD_META)=) \ @@ -36,19 +32,19 @@ image-build: --target coredns \ --tag $(ORG)/hardened-coredns:$(TAG) \ --tag $(ORG)/hardened-coredns:$(TAG)-$(ARCH) \ + --load \ . -.PHONY: image-push -image-push: - docker push $(ORG)/hardened-coredns:$(TAG)-$(ARCH) - -.PHONY: image-manifest -image-manifest: - DOCKER_CLI_EXPERIMENTAL=enabled docker manifest create --amend \ - $(ORG)/hardened-coredns:$(TAG) \ - $(ORG)/hardened-coredns:$(TAG)-$(ARCH) - DOCKER_CLI_EXPERIMENTAL=enabled docker manifest push \ - $(ORG)/hardened-coredns:$(TAG) +PHONY: log +log: + @echo "ARCH=$(ARCH)" + @echo "TAG=$(TAG)" + @echo "ORG=$(ORG)" + @echo "PKG=$(PKG)" + @echo "SRC=$(SRC)" + @echo "BUILD_META=$(BUILD_META)" + @echo "K3S_ROOT_VERSION=$(K3S_ROOT_VERSION)" + @echo "UNAME_M=$(UNAME_M)" .PHONY: image-scan image-scan: diff --git a/manifest-coredns.tmpl b/manifest-coredns.tmpl deleted file mode 100644 index 1a32212..0000000 --- a/manifest-coredns.tmpl +++ /dev/null @@ -1,12 +0,0 @@ -image: rancher/hardened-coredns:{{build.tag}} -manifests: - - - image: rancher/hardened-coredns:{{build.tag}}-amd64 - platform: - architecture: amd64 - os: linux - - - image: rancher/hardened-coredns:{{build.tag}}-arm64 - platform: - architecture: arm64 - os: linux diff --git a/updatecli/updatecli.d/updatebuildbase.yaml b/updatecli/updatecli.d/updatebuildbase.yaml index 322bd65..145e739 100644 --- a/updatecli/updatecli.d/updatebuildbase.yaml +++ b/updatecli/updatecli.d/updatebuildbase.yaml @@ -42,16 +42,6 @@ targets: transformers: - addprefix: "rancher/hardened-build-base:" - drone: - name: "Bump to latest build base version in Dockerfile" - kind: file - scmid: default - disablesourceinput: true - spec: - file: .drone.yml - matchpattern: '(?m)^ image: rancher/hardened-build-base:(.*)' - replacepattern: ' image: rancher/hardened-build-base:{{ source "buildbase" }}' - scms: default: kind: github