|
| 1 | +name: Vib Build |
| 2 | + |
| 3 | +on: |
| 4 | + push: |
| 5 | + branches: |
| 6 | + - 'dev' |
| 7 | + tags: |
| 8 | + - '*' |
| 9 | + workflow_dispatch: |
| 10 | + pull_request: |
| 11 | + |
| 12 | +env: |
| 13 | + BUILDX_NO_DEFAULT_ATTESTATIONS: 1 |
| 14 | + |
| 15 | +jobs: |
| 16 | + verify-image: |
| 17 | + runs-on: ubuntu-latest |
| 18 | + |
| 19 | + steps: |
| 20 | + - name: Verify Base Image Integrity |
| 21 | + if: ${{ github.ref_type == 'tag' }} |
| 22 | + run: |
| 23 | + gh attestation verify oci://ghcr.io/vanilla-os/desktop:main --owner Vanilla-OS |
| 24 | + env: |
| 25 | + GH_TOKEN: ${{ github.token }} |
| 26 | + |
| 27 | + build: |
| 28 | + strategy: |
| 29 | + fail-fast: false |
| 30 | + matrix: |
| 31 | + include: |
| 32 | + - runner: ubuntu-latest |
| 33 | + arch: amd64 |
| 34 | + - runner: ubuntu-24.04-arm |
| 35 | + arch: arm64 |
| 36 | + runs-on: ${{ matrix.runner }} |
| 37 | + needs: verify-image |
| 38 | + permissions: |
| 39 | + packages: write # Allow pushing images to GHCR |
| 40 | + attestations: write # To create and write attestations |
| 41 | + id-token: write # Additional permissions for the persistence of the attestations |
| 42 | + |
| 43 | + steps: |
| 44 | + - uses: actions/checkout@v6 |
| 45 | + |
| 46 | + - name: Change tag in recipe. |
| 47 | + if: ${{ github.ref_type == 'tag' }} |
| 48 | + run: | |
| 49 | + sed 's/ghcr.io\/vanilla-os\/desktop:dev/ghcr.io\/vanilla-os\/desktop:main/' -i recipe.yml |
| 50 | +
|
| 51 | + - uses: vanilla-os/vib-gh-action@v1.1.0 |
| 52 | + with: |
| 53 | + recipe: 'recipe.yml' |
| 54 | + |
| 55 | + - uses: actions/upload-artifact@v7 |
| 56 | + with: |
| 57 | + name: Containerfile |
| 58 | + path: Containerfile |
| 59 | + overwrite: true |
| 60 | + |
| 61 | + - name: Generate image name |
| 62 | + run: | |
| 63 | + REPO_OWNER_LOWERCASE="$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" |
| 64 | + echo "REPO_OWNER_LOWERCASE=$REPO_OWNER_LOWERCASE" >> "$GITHUB_ENV" |
| 65 | + echo "IMAGE_URL=ghcr.io/$REPO_OWNER_LOWERCASE/waydroid" >> "$GITHUB_ENV" |
| 66 | +
|
| 67 | + - name: Docker meta |
| 68 | + id: meta |
| 69 | + uses: docker/metadata-action@v6 |
| 70 | + with: |
| 71 | + images: ${{ env.IMAGE_URL }} |
| 72 | + labels: org.opencontainers.image.created={{commit_date 'YYYY-MM-DDTHH:mm:ss.SSS[Z]'}} |
| 73 | + |
| 74 | + - name: Set up Docker Buildx |
| 75 | + uses: docker/setup-buildx-action@v4 |
| 76 | + |
| 77 | + - name: Login to GitHub Package Registry |
| 78 | + uses: docker/login-action@v4 |
| 79 | + if: ${{ github.event_name != 'pull_request' }} |
| 80 | + with: |
| 81 | + registry: ghcr.io |
| 82 | + username: ${{ github.repository_owner }} |
| 83 | + password: ${{ secrets.GITHUB_TOKEN }} |
| 84 | + |
| 85 | + - name: Get Git commit timestamps |
| 86 | + run: echo "TIMESTAMP=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV |
| 87 | + |
| 88 | + - name: Build and push by digest |
| 89 | + id: build |
| 90 | + uses: docker/build-push-action@v7 |
| 91 | + with: |
| 92 | + context: . |
| 93 | + file: Containerfile |
| 94 | + tags: ${{ env.IMAGE_URL }} |
| 95 | + labels: ${{ steps.meta.outputs.labels }} |
| 96 | + cache-from: type=gha |
| 97 | + cache-to: type=gha,mode=max |
| 98 | + platforms: linux/${{ matrix.arch }} |
| 99 | + provenance: false |
| 100 | + outputs: type=image,push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }},rewrite-timestamp=true |
| 101 | + env: |
| 102 | + SOURCE_DATE_EPOCH: ${{ env.TIMESTAMP }} |
| 103 | + |
| 104 | + - name: Attest pushed image |
| 105 | + uses: actions/attest-build-provenance@v4 |
| 106 | + id: attest |
| 107 | + if: ${{ github.event_name != 'pull_request' }} |
| 108 | + with: |
| 109 | + subject-name: ${{ env.IMAGE_URL }} |
| 110 | + subject-digest: ${{ steps.build.outputs.digest }} |
| 111 | + push-to-registry: false |
| 112 | + |
| 113 | + - name: Export digest |
| 114 | + if: ${{ github.event_name != 'pull_request' }} |
| 115 | + run: | |
| 116 | + mkdir -p ${{ runner.temp }}/digests |
| 117 | + digest="${{ steps.build.outputs.digest }}" |
| 118 | + touch "${{ runner.temp }}/digests/${digest#sha256:}" |
| 119 | +
|
| 120 | + - name: Upload digest |
| 121 | + uses: actions/upload-artifact@v7 |
| 122 | + if: ${{ github.event_name != 'pull_request' }} |
| 123 | + with: |
| 124 | + name: digests-${{ matrix.arch }} |
| 125 | + path: ${{ runner.temp }}/digests/* |
| 126 | + if-no-files-found: error |
| 127 | + retention-days: 1 |
| 128 | + |
| 129 | + merge: |
| 130 | + runs-on: ubuntu-latest |
| 131 | + if: ${{ github.event_name != 'pull_request' }} |
| 132 | + needs: build |
| 133 | + permissions: |
| 134 | + contents: write # Allow actions to create release |
| 135 | + packages: write # Allow pushing images to GHCR |
| 136 | + |
| 137 | + steps: |
| 138 | + - name: Generate image name |
| 139 | + run: | |
| 140 | + REPO_OWNER_LOWERCASE="$(echo ${{ github.repository_owner }} | tr '[:upper:]' '[:lower:]')" |
| 141 | + echo "REPO_OWNER_LOWERCASE=$REPO_OWNER_LOWERCASE" >> "$GITHUB_ENV" |
| 142 | + echo "IMAGE_URL=ghcr.io/$REPO_OWNER_LOWERCASE/waydroid" >> "$GITHUB_ENV" |
| 143 | +
|
| 144 | + - name: Download digests |
| 145 | + uses: actions/download-artifact@v8 |
| 146 | + with: |
| 147 | + path: ${{ runner.temp }}/digests |
| 148 | + pattern: digests-* |
| 149 | + merge-multiple: true |
| 150 | + |
| 151 | + - name: Extra image tag branch |
| 152 | + if: ${{ github.ref_type != 'tag' }} |
| 153 | + run: | |
| 154 | + echo "EXTRA_TAG=ref,event=branch" >> "$GITHUB_ENV" |
| 155 | +
|
| 156 | + - name: Extra image tag release |
| 157 | + if: ${{ github.ref_type == 'tag' }} |
| 158 | + run: | |
| 159 | + echo "EXTRA_TAG=raw,main" >> "$GITHUB_ENV" |
| 160 | +
|
| 161 | + - name: Docker meta |
| 162 | + id: meta |
| 163 | + uses: docker/metadata-action@v6 |
| 164 | + with: |
| 165 | + images: ${{ env.IMAGE_URL }} |
| 166 | + tags: | |
| 167 | + type=semver,pattern={{version}} |
| 168 | + type=semver,pattern={{major}}.{{minor}} |
| 169 | + type=semver,pattern={{raw}} |
| 170 | + type=semver,pattern=v{{major}} |
| 171 | + type=${{ env.EXTRA_TAG }} |
| 172 | +
|
| 173 | + - name: Set up Docker Buildx |
| 174 | + uses: docker/setup-buildx-action@v4 |
| 175 | + |
| 176 | + - name: Login to GitHub Package Registry |
| 177 | + uses: docker/login-action@v4 |
| 178 | + with: |
| 179 | + registry: ghcr.io |
| 180 | + username: ${{ github.repository_owner }} |
| 181 | + password: ${{ secrets.GITHUB_TOKEN }} |
| 182 | + |
| 183 | + - name: Create manifest list and push |
| 184 | + working-directory: ${{ runner.temp }}/digests |
| 185 | + run: | |
| 186 | + docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \ |
| 187 | + $(printf '${{ env.IMAGE_URL }}@sha256:%s ' *) |
| 188 | +
|
| 189 | + differ: |
| 190 | + runs-on: ubuntu-latest |
| 191 | + if: github.repository == 'vanilla-os/waydroid-image' && github.ref_type == 'tag' |
| 192 | + needs: merge |
| 193 | + container: |
| 194 | + image: ghcr.io/vanilla-os/waydroid:main |
| 195 | + |
| 196 | + steps: |
| 197 | + - uses: actions/checkout@v6 |
| 198 | + |
| 199 | + - name: Generate package diff |
| 200 | + run: | |
| 201 | + lpkg --unlock |
| 202 | + PACKAGE_LIST=$(.github/gen_package_list.sh) |
| 203 | + apt-get install -y curl |
| 204 | + IMAGE_DIGEST=$(curl -s -L -H "Accept: application/vnd.github+json" \ |
| 205 | + -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \ |
| 206 | + -H "X-GitHub-Api-Version: 2022-11-28" \ |
| 207 | + https://api.github.com/orgs/Vanilla-OS/packages/container/waydroid/versions | grep -m1 name | sed -E 's/^\s*"name": "(.+)".*$/\1/') |
| 208 | + curl -X POST \ |
| 209 | + -H 'Accept:application/json' \ |
| 210 | + -H "Authorization:Basic $(echo -n "${{ secrets.DIFFER_USER }}:${{ secrets.DIFFER_PSW }}" | base64)" \ |
| 211 | + -d "{\"digest\":\"${IMAGE_DIGEST}\",${PACKAGE_LIST}}" \ |
| 212 | + ${{ vars.DIFFER_URL }}/images/waydroid/new |
| 213 | + lpkg --lock |
0 commit comments