Skip to content
.github/workflows/wc-build-push.yml

fix secrets #1

Sign in to view logs

fix secrets

fix secrets #1

Workflow file for this run

.github/workflows/wc-build-push.yml at b9e13ca
---
name: Build & Push
on:
workflow_call:
inputs:
flavor:
required: true
type: string
secrets:
DOCKERHUB_TOKEN:
required: true
PRIVATE_REPO_TOKEN:
required: true
permissions:
contents: read
env:
CONTAINER_FLAVOR: ${{ inputs.flavor }}
jobs:
build-push:
strategy:
matrix:
runner: ["ubuntu-latest", "ubuntu-24.04-arm"]
runs-on: ${{ matrix.runner }}
permissions:
packages: write
steps:
- name: Configure Git
run: |
git config --global url."https://${{ secrets.PRIVATE_REPO_TOKEN }}@github.com/".insteadOf "https://github.com/"
git config --global url."https://github.com/".insteadOf "git@github.com:"
- uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
with:
disable-sudo: true
egress-policy: audit
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
<<<<<<< Updated upstream

Check failure on line 43 in .github/workflows/wc-build-push.yml

View workflow run for this annotation

GitHub Actions / .github/workflows/wc-build-push.yml

Invalid workflow file 

You have an error in your yaml syntax on line 43
=======
- name: Debug secret availability (build-push job)
run: |
echo "DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USERNAME }}"
echo "DOCKERHUB_TOKEN available: ${{ secrets.DOCKERHUB_TOKEN != '' }}"
echo "GITHUB_TOKEN available: ${{ secrets.GITHUB_TOKEN != '' }}"
echo "Running from PR: ${{ github.event_name == 'pull_request' }}"
env:
DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
>>>>>>> Stashed changes
- uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
env:
DOCKER_METADATA_SET_OUTPUT_ENV: false
id: metadata
with:
images: ghcr.io/${{ github.repository_owner }}/embedded-devcontainer-${{ inputs.flavor }}
# Generate image LABEL for devcontainer.metadata
# the sed expression is a workaround for quotes being eaten in arrays (e.g. ["x", "y", "z"] -> ["x",y,"z"])
- run: echo "metadata=$(jq -cj '[.]' ".devcontainer/${CONTAINER_FLAVOR}/devcontainer-metadata-vscode.json" | sed 's/,"/, "/g')" >> "$GITHUB_OUTPUT"
id: devcontainer-metadata
- run: echo "git-commit-epoch=$(git log -1 --pretty=%ct)" >> "$GITHUB_OUTPUT"
id: devcontainer-epoch
- run: echo "arch=${RUNNER_ARCH@L}" >> "$GITHUB_OUTPUT"
id: devcontainer-arch
- uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
id: build-and-push
env:
SOURCE_DATE_EPOCH: ${{ steps.devcontainer-epoch.outputs.git-commit-epoch }}
with:
file: .devcontainer/${{ inputs.flavor }}/Dockerfile
push: true
tags: ghcr.io/${{ github.repository_owner }}/embedded-devcontainer-${{ inputs.flavor }}
labels: |
${{ steps.metadata.outputs.labels }}
devcontainer.metadata=${{ steps.devcontainer-metadata.outputs.metadata }}
annotations: ${{ steps.metadata.outputs.annotations }}
sbom: true
outputs: type=image,push-by-digest=true,name-canonical=true
- name: Export digest
run: |
set -Eeuo pipefail
mkdir -p "${RUNNER_TEMP}/digests"
touch "${RUNNER_TEMP}/digests/${DIGEST#sha256:}"
env:
DIGEST: ${{ steps.build-and-push.outputs.digest }}
RUNNER_TEMP: ${{ runner.temp }}
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: digests-${{ inputs.flavor }}-${{ steps.devcontainer-arch.outputs.arch }}
path: ${{ runner.temp }}/digests/*
if-no-files-found: error
retention-days: 1
merge-image:
runs-on: ubuntu-latest
needs: build-push
permissions:
actions: read
attestations: write
# dependency-submission needs contents write permission.
contents: write
# attest-build-provenance needs id-token write permission.
id-token: write
packages: write
pull-requests: write
steps:
- uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
with:
disable-sudo: true
egress-policy: audit
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
with:
path: ${{ runner.temp }}/digests
pattern: digests-${{ inputs.flavor }}-*
merge-multiple: true
- uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
<<<<<<< Updated upstream
=======
- name: Debug secret availability (merge-image job)
run: |
echo "DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USERNAME }}"
echo "DOCKERHUB_TOKEN available: ${{ secrets.DOCKERHUB_TOKEN != '' }}"
echo "GITHUB_TOKEN available: ${{ secrets.GITHUB_TOKEN != '' }}"
echo "Running from PR: ${{ github.event_name == 'pull_request' }}"
env:
DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
>>>>>>> Stashed changes
- uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
id: metadata
env:
DOCKER_METADATA_ANNOTATIONS_LEVELS: index
DOCKER_METADATA_SET_OUTPUT_ENV: false
with:
images: ghcr.io/${{ github.repository_owner }}/embedded-devcontainer-${{ inputs.flavor }}
# Generate Docker tags based on the following events/attributes.
# To prevent unnecessary image builds we simulate the `type=edge` tag
# with `type=raw,value=edge,enable=...` which only enables the tag
# for a `merge_group` event, this removes the need to build on `push`.
tags: |
type=raw,value=edge,enable=${{ github.event_name == 'merge_group' }}
type=ref,event=pr
type=semver,pattern={{raw}}
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
type=semver,pattern={{major}}
- name: Create manifest list and push
working-directory: ${{ runner.temp }}/digests
run: |
set -Eeuo pipefail
# shellcheck disable=SC2046
docker buildx imagetools create \
$(echo '${{ steps.metadata.outputs.json }}' | jq -r '.tags | map("--tag " + .) | join(" ")') \
$(printf 'ghcr.io/${{ github.repository_owner }}/embedded-devcontainer-${{ inputs.flavor }}@sha256:%s ' *)
- name: Inspect manifest and extract digest
id: inspect-manifest
run: |
set -Eeuo pipefail
output=$(docker buildx imagetools inspect ghcr.io/${{ github.repository_owner }}/embedded-devcontainer-${{ inputs.flavor }}:${{ steps.metadata.outputs.version }} --format '{{json .}}')
echo "digest=$(echo "$output" | jq -r '.manifest.digest // .manifests[0].digest')" >> "$GITHUB_OUTPUT"
env:
CONTAINER_VERSION: ${{ steps.metadata.outputs.version }}
GH_REPO: ${{ github.repository }}
- run: |
set -Eeuo pipefail
wget -O diffoci https://github.com/reproducible-containers/diffoci/releases/download/v0.1.7/diffoci-v0.1.7.linux-amd64
chmod +x diffoci
./diffoci diff --semantic --report-file=container-diff.json "${FROM_CONTAINER}" "${TO_CONTAINER}" || true
env:
FROM_CONTAINER: ghcr.io/${{ github.repository_owner }}/embedded-devcontainer-${{ inputs.flavor }}:edge
TO_CONTAINER: ghcr.io/${{ github.repository_owner }}/embedded-devcontainer-${{ inputs.flavor }}:${{ steps.metadata.outputs.version }}
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: container-diff-${{ inputs.flavor }}
path: container-diff.json
retention-days: 10
- uses: ./.github/actions/container-size-diff
id: container-size-diff
with:
from-container: ghcr.io/${{ github.repository_owner }}/embedded-devcontainer-${{ inputs.flavor }}:edge
to-container: ghcr.io/${{ github.repository_owner }}/embedded-devcontainer-${{ inputs.flavor }}:${{ steps.metadata.outputs.version }}
- uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
with:
header: container-size-diff-${{ inputs.flavor }}
message: |
${{ steps.container-size-diff.outputs.size-diff-markdown }}
- uses: anchore/sbom-action@f8bdd1d8ac5e901a77a92f111440fdb1b593736b # v0.20.6
with:
image: ghcr.io/${{ github.repository_owner }}/embedded-devcontainer-${{ inputs.flavor }}@${{ steps.inspect-manifest.outputs.digest }}
dependency-snapshot: true
- uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
with:
subject-name: ${{ vars.DOCKERHUB_USERNAME }}/embedded-devcontainer-${{ inputs.flavor }}
subject-digest: ${{ steps.inspect-manifest.outputs.digest }}
show-summary: false
push-to-registry: true
- name: Verify attestation
run: gh attestation verify --repo "${GH_REPO}" "oci://${{ vars.DOCKERHUB_USERNAME }}/${GH_REPO}-${CONTAINER_FLAVOR}@${DIGEST}"
env:
DIGEST: ${{ steps.inspect-manifest.outputs.digest }}
GH_REPO: ${{ github.repository }}
GH_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}