domain-security-scanner/.github/workflows/release.yml at 7ab3f51dd80062779e333a9d19caa904dba8dea8 · globalcyberalliance/domain-security-scanner · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
name: Release
on:
  release:
    types: [ released ]

jobs:
  binary:
    name: Build and Release Binaries
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repo
        uses: actions/checkout@v4

      - name: Setup Go Environment
        uses: actions/setup-go@v5
        with:
          go-version: '^1.25.0'

      - name: Build Binaries
        run: |
          mkdir -p builds/compressed
          go install github.com/mitchellh/gox@latest
          cd cmd/dss
          gox --output "../../builds/dss-{{.OS}}-{{.Arch}}" -ldflags '-s -w' -osarch 'darwin/amd64 darwin/arm64 linux/amd64 linux/arm freebsd/amd64 windows/amd64'
          cd ../../builds
          find . -maxdepth 1 -type f -execdir zip 'compressed/{}.zip' '{}' \;

      - name: Upload Release Assets
        uses: softprops/action-gh-release@v2
        with:
          files: builds/compressed/*.zip
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  setup:
    name: Setup Build Metadata
    runs-on: ubuntu-latest
    outputs:
      image_id: ${{ steps.setenv.outputs.image_id }}
      cache_tags: ${{ steps.setenv.outputs.cache_tags }}
      tags: ${{ steps.setenv.outputs.tags }}
      tags_latest: ${{ steps.setenv.outputs.tags_latest }}
    steps:
      - name: Checkout Repo
        uses: actions/checkout@v4

      - id: setenv
        run: |
          IMAGE_ID=${GITHUB_REPOSITORY,,}
          TAG_NAME="${{ github.ref_name }}"

          # Support both specific version (from release tag) and latest
          TAGS="ghcr.io/${IMAGE_ID}:${TAG_NAME}"
          TAGS_LATEST="ghcr.io/${IMAGE_ID}:latest"
          CACHE_TAGS="ghcr.io/${IMAGE_ID}:buildcache"

          echo "image_id=$IMAGE_ID" >> $GITHUB_OUTPUT
          echo "tags=$TAGS" >> $GITHUB_OUTPUT
          echo "tags_latest=$TAGS_LATEST" >> $GITHUB_OUTPUT
          echo "cache_tags=$CACHE_TAGS" >> $GITHUB_OUTPUT

  build-amd64:
    name: Build amd64 image
    runs-on: ubuntu-latest
    needs: setup
    steps:
      - uses: actions/checkout@v4

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          install: true
          driver-opts: |
            network=host

      - name: Build amd64 image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: Dockerfile
          push: true
          platforms: linux/amd64
          tags: ghcr.io/${{ needs.setup.outputs.image_id }}:amd64
          cache-from: type=registry,ref=${{ needs.setup.outputs.cache_tags }}
          cache-to: type=registry,ref=${{ needs.setup.outputs.cache_tags }},mode=max
          build-args: |
            GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}

  build-arm64:
    name: Build arm64 image
    runs-on: ubuntu-24.04-arm
    needs: setup
    steps:
      - uses: actions/checkout@v4

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
        with:
          install: true
          driver-opts: |
            network=host

      - name: Build arm64 image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: Dockerfile
          push: true
          platforms: linux/arm64
          tags: ghcr.io/${{ needs.setup.outputs.image_id }}:arm64
          cache-from: type=registry,ref=${{ needs.setup.outputs.cache_tags }}
          cache-to: type=registry,ref=${{ needs.setup.outputs.cache_tags }},mode=max
          build-args: |
            GITHUB_TOKEN=${{ secrets.GH_ACCESS_TOKEN }}

  merge:
    name: Merge multi-arch image
    runs-on: ubuntu-latest
    needs: [ setup, build-amd64, build-arm64 ]
    outputs:
      image_tag: ${{ needs.setup.outputs.tags }}
    steps:
      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Get tag values
        run: |
          echo "Image ID: ${{ needs.setup.outputs.image_id }}"
          echo "Tags: ${{ needs.setup.outputs.tags }}"
          echo "Tags Latest: ${{ needs.setup.outputs.tags_latest }}"

      - name: Create and push multi-arch manifest
        run: |
          docker buildx imagetools create \
            -t ${{ needs.setup.outputs.tags }} \
            -t ${{ needs.setup.outputs.tags_latest }} \
            ghcr.io/${{ needs.setup.outputs.image_id }}:amd64 \
            ghcr.io/${{ needs.setup.outputs.image_id }}:arm64

      - name: Verify manifest
        run: |
          docker buildx imagetools inspect ${{ needs.setup.outputs.tags }}