build-blueconfig #1283
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: build-blueconfig | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: "35 04 * * *" | |
| push: | |
| branches: | |
| - master | |
| paths-ignore: | |
| - "**.md" | |
| - "**.txt" | |
| - "post-install/**" | |
| env: | |
| UPSTREAM_IMAGE: quay.io/fedora-ostree-desktops/silverblue | |
| IMAGE_NAME: blueconfig | |
| IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }} | |
| # Prevent multiple workflow runs from racing to ensure that pushes are made | |
| # sequentially for the main branch. Also cancel in progress workflow runs for | |
| # pull requests only. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| jobs: | |
| build-and-push: | |
| name: Build and push image | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| strategy: | |
| max-parallel: 1 | |
| # When set to true, GitHub cancels all in-progress jobs if any matrix job fails. | |
| fail-fast: true | |
| matrix: | |
| major_version: ["43"] | |
| include: | |
| - variant: "stable" | |
| container_file: "Containerfile" | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| - name: Check for new upstream version | |
| id: check-new-version | |
| shell: bash | |
| run: | | |
| if [[ "${{ github.event_name }}" != "schedule" ]]; then | |
| echo "Not running an schedule event (${{ github.event_name }}), skipping version check." | |
| echo "continue=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| export DEBIAN_FRONTEND=noninteractive | |
| sudo apt-get update -y && sudo apt-get install -y skopeo jq | |
| if bash ./check-upstream-version.sh "${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ matrix.major_version }}" "${{ env.UPSTREAM_IMAGE }}:${{ matrix.major_version }}"; then | |
| echo "continue=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "continue=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| # Build image using Buildah action | |
| - name: Build Image | |
| if: steps.check-new-version.outputs.continue == 'true' | |
| id: build_image | |
| uses: redhat-actions/buildah-build@v2 | |
| with: | |
| image: ${{ env.IMAGE_NAME }} | |
| containerfiles: | | |
| ./${{ matrix.container_file }} | |
| tags: | | |
| ${{ matrix.major_version }} | |
| ${{ matrix.variant }} | |
| build-args: | | |
| UPSTREAM_IMAGE=${{ env.UPSTREAM_IMAGE }} | |
| FEDORA_MAJOR_VERSION=${{ matrix.major_version }} | |
| layers: false | |
| oci: true | |
| # Push the image to GHCR (Image Registry) | |
| - name: Push To GHCR | |
| uses: redhat-actions/push-to-registry@v2 | |
| id: push | |
| if: github.event_name != 'pull_request' && steps.check-new-version.outputs.continue == 'true' | |
| with: | |
| image: ${{ steps.build_image.outputs.image }} | |
| tags: ${{ steps.build_image.outputs.tags }} | |
| registry: ${{ env.IMAGE_REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ github.token }} | |
| extra-args: | | |
| --compression-format=zstd | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| if: github.event_name != 'pull_request' && steps.check-new-version.outputs.continue == 'true' | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # Sign container | |
| - uses: sigstore/cosign-installer@v4.0.0 | |
| if: github.event_name != 'pull_request' && steps.check-new-version.outputs.continue == 'true' | |
| - name: Sign container image | |
| if: github.event_name != 'pull_request' && steps.check-new-version.outputs.continue == 'true' | |
| run: | | |
| echo "${{ env.COSIGN_PRIVATE_KEY }}" > cosign.key | |
| cosign sign -y --key cosign.key ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}@${TAGS} | |
| env: | |
| TAGS: ${{ steps.push.outputs.digest }} | |
| COSIGN_EXPERIMENTAL: false | |
| COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }} |