mirror of
https://github.com/ethereum/go-ethereum.git
synced 2026-07-24 13:46:43 +00:00
fix docker cosign action (#38)
This commit is contained in:
Cal Bera
GitHub
parent
3dc61aece5
commit
65942a54f5
3 changed files with 50 additions and 33 deletions
47
.github/workflows/docker.yml
vendored
47
.github/workflows/docker.yml
vendored
|
|
@ -6,9 +6,10 @@ on:
|
|||
- "v1.*"
|
||||
branches:
|
||||
- "main"
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
docker:
|
||||
docker-build:
|
||||
name: Docker Image
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
|
|
@ -38,9 +39,6 @@ jobs:
|
|||
username: ${{ github.actor }}
|
||||
password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Install Cosign
|
||||
uses: sigstore/cosign-installer@v3
|
||||
|
||||
- name: Build and push multi-arch images to GHCR
|
||||
run: |
|
||||
go run build/ci.go dockerx -platform linux/amd64,linux/arm64 -hub ghcr.io/berachain/bera-geth -upload
|
||||
|
|
@ -50,26 +48,47 @@ jobs:
|
|||
run: |
|
||||
# Extract version information
|
||||
if [[ "${{ github.ref }}" == refs/tags/* ]]; then
|
||||
VERSION="${{ github.ref_name }}"
|
||||
echo "VERSION=${{ github.ref_name }}" >> $GITHUB_OUTPUT
|
||||
elif [[ "${{ github.ref }}" == refs/heads/main ]]; then
|
||||
VERSION="latest"
|
||||
echo "VERSION=latest" >> $GITHUB_OUTPUT
|
||||
else
|
||||
VERSION="branch-${GITHUB_REF##*/}"
|
||||
echo "VERSION=" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
|
||||
# Get the digest of the pushed image. The --format option can be unreliable,
|
||||
# so we parse the full JSON output to find the digest of the manifest list.
|
||||
MANIFEST_JSON=$(docker buildx imagetools inspect ghcr.io/berachain/bera-geth:${VERSION})
|
||||
DIGEST=$(echo "${MANIFEST_JSON}" | grep '"digest"' | head -n 1 | cut -d '"' -f 4)
|
||||
echo "digest=${DIGEST}" >> $GITHUB_OUTPUT
|
||||
echo "version=${VERSION}" >> $GITHUB_OUTPUT
|
||||
echo "DIGEST=$(echo "${MANIFEST_JSON}" | grep '"digest"' | head -n 1 | cut -d '"' -f 4)" >> $GITHUB_OUTPUT
|
||||
outputs:
|
||||
VERSION: ${{ steps.image_info.outputs.VERSION }}
|
||||
DIGEST: ${{ steps.image_info.outputs.DIGEST }}
|
||||
|
||||
docker-signatures:
|
||||
name: Docker Signatures
|
||||
needs: [docker-build]
|
||||
runs-on: ubuntu-latest
|
||||
env:
|
||||
VERSION: ${{ needs.docker-build.outputs.VERSION }}
|
||||
DIGEST: ${{ needs.docker-build.outputs.DIGEST }}
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
attestations: write
|
||||
id-token: write
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Install Cosign
|
||||
uses: sigstore/cosign-installer@v3
|
||||
|
||||
- name: Sign Docker images with Cosign
|
||||
env:
|
||||
COSIGN_EXPERIMENTAL: true
|
||||
run: |
|
||||
# Sign the multi-arch manifest by digest
|
||||
cosign sign --yes ghcr.io/berachain/bera-geth@${{ steps.image_info.outputs.digest }}
|
||||
# Sign the tagged version if it exists
|
||||
if [ -n "${{ env.VERSION }}" ]; then
|
||||
cosign sign --yes ghcr.io/berachain/bera-geth:${{ env.VERSION }}
|
||||
fi
|
||||
|
||||
# Also sign the tagged version
|
||||
cosign sign --yes ghcr.io/berachain/bera-geth:${{ steps.image_info.outputs.version }}
|
||||
# Sign the multi-arch manifest by digest
|
||||
cosign sign --yes ghcr.io/berachain/bera-geth@${{ env.DIGEST }}
|
||||
|
|
|
|||
1
.github/workflows/release.yml
vendored
1
.github/workflows/release.yml
vendored
|
|
@ -4,6 +4,7 @@ on:
|
|||
push:
|
||||
tags:
|
||||
- "v1.*"
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
extract-version:
|
||||
|
|
|
|||
35
build/ci.go
35
build/ci.go
|
|
@ -684,13 +684,12 @@ func doDockerBuildx(cmdline []string) {
|
|||
// - ethereum/client-go:alltools-latest - Pushes to the main branch, Geth & tools
|
||||
// - ethereum/client-go:v<major>.<minor>.<patch> - Version tag publish on GitHub, Geth only
|
||||
// - ethereum/client-go:alltools-v<major>.<minor>.<patch> - Version tag publish on GitHub, Geth & tools
|
||||
var tags []string
|
||||
|
||||
var tag string
|
||||
switch {
|
||||
case env.Branch == "main":
|
||||
tags = []string{"latest"}
|
||||
tag = "latest"
|
||||
case strings.HasPrefix(env.Tag, "v1."):
|
||||
tags = []string{env.Tag}
|
||||
tag = env.Tag
|
||||
}
|
||||
// Need to create a mult-arch builder
|
||||
check := exec.Command("docker", "buildx", "inspect", "multi-arch-builder")
|
||||
|
|
@ -705,22 +704,20 @@ func doDockerBuildx(cmdline []string) {
|
|||
{file: "Dockerfile", base: fmt.Sprintf("%s:", *hubImage)},
|
||||
{file: "Dockerfile.alltools", base: fmt.Sprintf("%s:alltools-", *hubImage)},
|
||||
} {
|
||||
for _, tag := range tags { // latest, stable etc
|
||||
gethImage := fmt.Sprintf("%s%s", spec.base, tag)
|
||||
cmd := exec.Command("docker", "buildx", "build",
|
||||
"--build-arg", "COMMIT="+env.Commit,
|
||||
"--build-arg", "VERSION="+version.WithMeta,
|
||||
"--build-arg", "BUILDNUM="+env.Buildnum,
|
||||
"--tag", gethImage,
|
||||
"--platform", *platform,
|
||||
"--file", spec.file,
|
||||
)
|
||||
if *upload {
|
||||
cmd.Args = append(cmd.Args, "--push")
|
||||
}
|
||||
cmd.Args = append(cmd.Args, ".")
|
||||
build.MustRun(cmd)
|
||||
gethImage := fmt.Sprintf("%s%s", spec.base, tag)
|
||||
cmd := exec.Command("docker", "buildx", "build",
|
||||
"--build-arg", "COMMIT="+env.Commit,
|
||||
"--build-arg", "VERSION="+version.WithMeta,
|
||||
"--build-arg", "BUILDNUM="+env.Buildnum,
|
||||
"--tag", gethImage,
|
||||
"--platform", *platform,
|
||||
"--file", spec.file,
|
||||
)
|
||||
if *upload {
|
||||
cmd.Args = append(cmd.Args, "--push")
|
||||
}
|
||||
cmd.Args = append(cmd.Args, ".")
|
||||
build.MustRun(cmd)
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue