diff --git a/.github/workflows/docker-build.yaml b/.github/workflows/docker-build.yaml new file mode 100644 index 0000000000000..5779c418782b8 --- /dev/null +++ b/.github/workflows/docker-build.yaml @@ -0,0 +1,39 @@ +name: docker-build +on: + pull_request: {} + push: + branches: + - "elx-vault-main" + +env: + IMAGE_NAME: elx-vault + +jobs: + push: + runs-on: self-hosted + permissions: + packages: write + contents: read + + steps: + - uses: actions/checkout@v5 + - name: Build image + run: docker build . --file Dockerfile.release --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}" + - name: Log in to registry + run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin + + - name: Push image + run: | + IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME + + IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]') + + VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,') + + [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//') + + [ "$VERSION" == "main" ] && VERSION=latest + echo IMAGE_ID=$IMAGE_ID + echo VERSION=$VERSION + docker tag $IMAGE_NAME $IMAGE_ID:$VERSION + docker push $IMAGE_ID:$VERSION diff --git a/Dockerfile.release b/Dockerfile.release index b2d05283850f8..7bae72b2c110d 100644 --- a/Dockerfile.release +++ b/Dockerfile.release @@ -15,24 +15,20 @@ RUN apk add -U --no-cache ca-certificates && \ go install aead.dev/minisign/cmd/minisign@v0.2.1 # Download minio binary and signature files -RUN curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE} -o /go/bin/minio && \ - curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE}.minisig -o /go/bin/minio.minisig && \ - curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE}.sha256sum -o /go/bin/minio.sha256sum && \ - chmod +x /go/bin/minio +#RUN curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE} -o /go/bin/minio && \ +# curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE}.minisig -o /go/bin/minio.minisig && \ +# curl -s -q https://dl.min.io/server/minio/release/linux-${TARGETARCH}/archive/minio.${RELEASE}.sha256sum -o /go/bin/minio.sha256sum && \ +# chmod +x /go/bin/minio + +RUN go install github.com/minio/minio@latest +RUN chmod +x /go/bin/minio # Download mc binary and signature files RUN curl -s -q https://dl.min.io/client/mc/release/linux-${TARGETARCH}/mc -o /go/bin/mc && \ - curl -s -q https://dl.min.io/client/mc/release/linux-${TARGETARCH}/mc.minisig -o /go/bin/mc.minisig && \ - curl -s -q https://dl.min.io/client/mc/release/linux-${TARGETARCH}/mc.sha256sum -o /go/bin/mc.sha256sum && \ chmod +x /go/bin/mc -# Verify binary signature using public key "RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGavRUN" -RUN minisign -Vqm /go/bin/minio -x /go/bin/minio.minisig -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav && \ - minisign -Vqm /go/bin/mc -x /go/bin/mc.minisig -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav - -COPY dockerscripts/download-static-curl.sh /build/download-static-curl -RUN chmod +x /build/download-static-curl && \ - /build/download-static-curl +RUN curl -f -L -s -q https://github.com/moparisthebest/static-curl/releases/latest/download/curl-amd64 -o /go/bin/curl +RUN chmod +x /go/bin/curl FROM registry.access.redhat.com/ubi9/ubi-micro:latest diff --git a/dockerscripts/download-static-curl.sh b/dockerscripts/download-static-curl.sh index 0f12464c8ce64..2cd4154c17fe1 100644 --- a/dockerscripts/download-static-curl.sh +++ b/dockerscripts/download-static-curl.sh @@ -2,19 +2,7 @@ function download_arch_specific_executable { curl -f -L -s -q \ - https://github.com/moparisthebest/static-curl/releases/latest/download/curl-$1 \ + https://github.com/moparisthebest/static-curl/releases/latest/download/curl-amd64 \ -o /go/bin/curl || exit 1 chmod +x /go/bin/curl } - -case $TARGETARCH in -"arm64") - download_arch_specific_executable aarch64 - ;; -"s390x") - echo "Not downloading static cURL because it does not exist for the $TARGETARCH architecture." - ;; -*) - download_arch_specific_executable "$TARGETARCH" - ;; -esac