Skip to content

Commit 759171f

Browse files
mchmarnymchmarny
committed
add tf, img build
1 parent 58aa08e commit 759171f

File tree

13 files changed

+589
-1
lines changed

13 files changed

+589
-1
lines changed

‎.github/workflows/build.yaml

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
name: build-image
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
image_repo:
7+
description: 'Fully-qualified image repo (registry/project/repo)'
8+
required: true
9+
type: string
10+
image_name:
11+
description: 'Image name (e.g. my-image)'
12+
required: true
13+
type: string
14+
auth_provider:
15+
description: 'OIDC provider ID'
16+
required: true
17+
type: string
18+
auth_user:
19+
description: 'OIDC user ID'
20+
required: true
21+
type: string
22+
outputs:
23+
digest:
24+
value: ${{ jobs.build.outputs.digest }}
25+
26+
permissions:
27+
contents: read
28+
29+
jobs:
30+
build:
31+
outputs:
32+
digest: ${{ steps.image.outputs.digest }}
33+
runs-on: ubuntu-latest
34+
permissions:
35+
actions: read
36+
id-token: write
37+
steps:
38+
39+
- name: Checkout Code
40+
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
41+
42+
- name: Get Version
43+
run: |-
44+
set -euo pipefail
45+
echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
46+
echo "CURRENT_DATE=$(date '+%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_ENV
47+
echo "RELEASE_COMMIT=${GITHUB_SHA}" >> $GITHUB_ENV
48+
49+
- id: auth
50+
name: Auth GCP
51+
uses: google-github-actions/auth@ef5d53e30bbcd8d0836f4288f5e50ff3e086997d # v1.0.0
52+
with:
53+
token_format: "access_token"
54+
workload_identity_provider: ${{ inputs.auth_provider }}
55+
service_account: ${{ inputs.auth_user }}
56+
57+
- name: Define Metadata
58+
id: meta
59+
uses: docker/metadata-action@507c2f2dc502c992ad446e3d7a5dfbe311567a96 # v4.3.0
60+
with:
61+
images: |
62+
${{ inputs.image_repo }}/${{ inputs.image_name }}
63+
tags: |
64+
type=raw,enable=true,value=${{ env.RELEASE_VERSION }}
65+
type=raw,enable=true,value=${{ env.RELEASE_COMMIT }}
66+
type=raw,enable=true,value=latest
67+
68+
- name: Registry Auth
69+
uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
70+
with:
71+
registry: ${{ inputs.image_repo }}
72+
username: oauth2accesstoken
73+
password: ${{ steps.auth.outputs.access_token }}
74+
75+
- name: Image Push
76+
id: push
77+
uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 # v4.0.0
78+
with:
79+
context: .
80+
file: internal/cmd/Dockerfile
81+
push: true
82+
tags: ${{ steps.meta.outputs.tags }}
83+
labels: ${{ steps.meta.outputs.labels }}
84+
build-args: |
85+
VERSION=${{ env.RELEASE_VERSION }}
86+
COMMIT=${{ env.RELEASE_COMMIT }}
87+
DATE=${{ env.CURRENT_DATE }}
88+
89+
- name: Export Digest
90+
id: image
91+
run: |
92+
echo "digest=${{ inputs.image_repo }}/${{ inputs.image_name }}@${{ steps.push.outputs.digest }}" >> $GITHUB_OUTPUT

‎.github/workflows/on-tag.yaml renamed to ‎.github/workflows/on-tag-cli.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: release
1+
name: release-cli
22
on:
33
push:
44
tags:

‎.github/workflows/on-tag-img.yaml

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
name: release-img
2+
on:
3+
push:
4+
tags:
5+
- 'v[0-9]+.[0-9]+.[0-9]+' # Only build tag with semantic versioning format
6+
7+
permissions:
8+
contents: read
9+
10+
jobs:
11+
12+
conf:
13+
env:
14+
IMG_NAME: vulctl
15+
PROVIDER_ID: projects/689738033528/locations/global/workloadIdentityPools/vulctl-github-pool/providers/github-provider
16+
REG_URI: us-west1-docker.pkg.dev/cloudy-build/vulctl
17+
SA_EMAIL: [email protected]
18+
PROJECT_ID: cloudy-build
19+
20+
# Defaults
21+
BUILDER_VERSION: v1.4.0
22+
COSIGN_VERSION: v1.13.1
23+
ERR_VULNERABILITY_SEV: "CRITICAL,HIGH,MEDIUM"
24+
GO_VERSION: "^1.20.2"
25+
26+
runs-on: ubuntu-latest
27+
permissions:
28+
contents: read
29+
outputs:
30+
builder_version: ${{ steps.conf.outputs.builder_version }}
31+
cosign_version: ${{ steps.conf.outputs.cosign_version }}
32+
err_on_vulnerability_sev: ${{ steps.conf.outputs.err_on_vulnerability_sev }}
33+
go_version: ${{ steps.conf.outputs.go_version }}
34+
image_name: ${{ steps.conf.outputs.image_name }}
35+
provider_id: ${{ steps.conf.outputs.provider_id }}
36+
registry_uri: ${{ steps.conf.outputs.registry_uri }}
37+
service_account: ${{ steps.conf.outputs.service_account }}
38+
project_id: ${{ steps.conf.outputs.project_id }}
39+
steps:
40+
41+
- name: Export Config
42+
id: conf
43+
run: |
44+
echo "builder_version=${{ env.BUILDER_VERSION }}" >> $GITHUB_OUTPUT
45+
echo "cosign_version=${{ env.COSIGN_VERSION }}" >> $GITHUB_OUTPUT
46+
echo "err_on_vulnerability_sev=${{ env.ERR_VULNERABILITY_SEV }}" >> $GITHUB_OUTPUT
47+
echo "go_version=${{ env.GO_VERSION }}" >> $GITHUB_OUTPUT
48+
echo "image_name=${{ env.IMG_NAME }}" >> $GITHUB_OUTPUT
49+
echo "provider_id=${{ env.PROVIDER_ID }}" >> $GITHUB_OUTPUT
50+
echo "registry_uri=${{ env.REG_URI }}" >> $GITHUB_OUTPUT
51+
echo "service_account=${{ env.SA_EMAIL }}" >> $GITHUB_OUTPUT
52+
echo "project_id=${{ env.PROJECT_ID }}" >> $GITHUB_OUTPUT
53+
54+
test:
55+
needs:
56+
- conf
57+
uses: ./.github/workflows/test.yaml
58+
permissions:
59+
contents: read
60+
security-events: write
61+
with:
62+
go-version: ${{ needs.conf.outputs.go_version }}
63+
scan-severity: ${{ needs.conf.outputs.err_on_vulnerability_sev }}
64+
65+
image:
66+
needs:
67+
- conf
68+
- test
69+
permissions:
70+
contents: read
71+
actions: read
72+
id-token: write
73+
packages: write
74+
uses: ./.github/workflows/build.yaml
75+
with:
76+
auth_provider: ${{ needs.conf.outputs.provider_id }}
77+
auth_user: ${{ needs.conf.outputs.service_account }}
78+
image_name: ${{ needs.conf.outputs.image_name }}
79+
image_repo: ${{ needs.conf.outputs.registry_uri }}
80+
81+
sign:
82+
needs:
83+
- conf
84+
- image
85+
permissions:
86+
contents: read
87+
actions: read
88+
id-token: write
89+
uses: ./.github/workflows/sign.yaml
90+
with:
91+
auth_provider: ${{ needs.conf.outputs.provider_id }}
92+
auth_user: ${{ needs.conf.outputs.service_account }}
93+
cosign_version: ${{ needs.conf.outputs.cosign_version }}
94+
image_digest: ${{ needs.image.outputs.digest }}
95+
scan_severity: ${{ needs.conf.outputs.err_on_vulnerability_sev }}
96+
97+
provenance:
98+
needs:
99+
- conf
100+
- sign
101+
- image
102+
permissions:
103+
contents: read
104+
actions: read
105+
id-token: write
106+
packages: write
107+
uses: ./.github/workflows/slsa.yaml
108+
with:
109+
auth_provider: ${{ needs.conf.outputs.provider_id }}
110+
auth_user: ${{ needs.conf.outputs.service_account }}
111+
image_digest: ${{ needs.image.outputs.digest }}

‎.github/workflows/sign.yaml

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
name: sign-image
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
image_digest:
7+
description: 'Fully-qualified image digest to verify (registry/image@sha256:digest)'
8+
required: true
9+
type: string
10+
auth_provider:
11+
description: 'OIDC provider ID'
12+
required: true
13+
type: string
14+
auth_user:
15+
description: 'OIDC user ID'
16+
required: true
17+
type: string
18+
cosign_version:
19+
description: 'The version of cosign to use'
20+
required: false
21+
type: string
22+
default: 'v1.13.1'
23+
scan_severity:
24+
description: 'Error on vulnerability scan severity'
25+
required: false
26+
type: string
27+
default: 'CRITICAL,HIGH,MEDIUM'
28+
29+
permissions:
30+
contents: read
31+
32+
jobs:
33+
34+
sign:
35+
runs-on: ubuntu-latest
36+
permissions:
37+
actions: read
38+
id-token: write
39+
steps:
40+
41+
- id: auth
42+
name: Auth GCP
43+
uses: google-github-actions/auth@ef5d53e30bbcd8d0836f4288f5e50ff3e086997d # v1.0.0
44+
with:
45+
token_format: "access_token"
46+
workload_identity_provider: ${{ inputs.auth_provider }}
47+
service_account: ${{ inputs.auth_user }}
48+
49+
- name: Install Cosign
50+
uses: sigstore/cosign-installer@c3667d99424e7e6047999fb6246c0da843953c65 # v3.0.1
51+
with:
52+
cosign-release: ${{ inputs.cosign_version }}
53+
54+
- name: Auth Cosign
55+
run: |
56+
set -euo pipefail
57+
cosign version
58+
reg=$(echo ${{ inputs.image_digest }} | cut -d/ -f1)
59+
cosign login ${reg} --username=oauth2accesstoken --password=${{ steps.auth.outputs.access_token }}
60+
61+
- name: Generate Keys
62+
run: |
63+
set -euo pipefail
64+
COSIGN_PASSWORD=$(openssl rand -base64 12)
65+
cosign generate-key-pair
66+
67+
- name: Attest Image
68+
env:
69+
COSIGN_EXPERIMENTAL: "true"
70+
run: |
71+
set -euo pipefail
72+
cosign sign ${{ inputs.image_digest }} \
73+
--force \
74+
--key cosign.key \
75+
-a sha=${{ github.sha }} \
76+
-a run_id=${{ github.run_id }} \
77+
-a run_attempt=${{ github.run_attempt }} \
78+
-a tag=${{ env.GITHUB_REF_NAME }}
79+
80+
- name: Attest Image
81+
env:
82+
COSIGN_EXPERIMENTAL: "true"
83+
run: |
84+
set -euo pipefail
85+
cosign verify \
86+
--key cosign.pub \
87+
${{ inputs.image_digest }}

‎.github/workflows/slsa.yaml

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
name: slsa-provenance-create
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
image_digest:
7+
description: 'Fully-qualified image digest to verify (registry/image@sha256:digest)'
8+
required: true
9+
type: string
10+
auth_provider:
11+
description: 'OIDC provider ID'
12+
required: true
13+
type: string
14+
auth_user:
15+
description: 'OIDC user ID'
16+
required: true
17+
type: string
18+
cosign_version:
19+
description: 'The version of cosign to use'
20+
required: false
21+
type: string
22+
default: 'v1.13.1'
23+
24+
permissions:
25+
contents: read
26+
27+
jobs:
28+
29+
conf:
30+
runs-on: ubuntu-latest
31+
permissions:
32+
contents: read
33+
outputs:
34+
image: ${{ steps.conf.outputs.image }}
35+
digest: ${{ steps.conf.outputs.digest }}
36+
steps:
37+
- name: Export Config
38+
id: conf
39+
run: |
40+
echo "image=$(echo ${{ inputs.image_digest }} | cut -d@ -f1)" >> $GITHUB_OUTPUT
41+
echo "digest=$(echo ${{ inputs.image_digest }} | cut -d@ -f2)" >> $GITHUB_OUTPUT
42+
43+
provenance:
44+
needs:
45+
- conf
46+
permissions:
47+
actions: read
48+
id-token: write
49+
packages: write
50+
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
51+
with:
52+
image: ${{ needs.conf.outputs.image }}
53+
digest: ${{ needs.conf.outputs.digest }}
54+
registry-username: ${{ github.actor }}
55+
gcp-workload-identity-provider: ${{ inputs.auth_provider }}
56+
gcp-service-account: ${{ inputs.auth_user }}
57+
58+
verify:
59+
needs:
60+
- provenance
61+
runs-on: ubuntu-latest
62+
permissions:
63+
actions: read
64+
id-token: write
65+
steps:
66+
67+
- name: Checkout Code
68+
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
69+
70+
- id: auth
71+
name: Auth GCP
72+
uses: google-github-actions/auth@ef5d53e30bbcd8d0836f4288f5e50ff3e086997d # v1.0.0
73+
with:
74+
token_format: "access_token"
75+
workload_identity_provider: ${{ inputs.auth_provider }}
76+
service_account: ${{ inputs.auth_user }}
77+
78+
- uses: slsa-framework/slsa-verifier/actions/installer@a43888265e1f6aae98c924538298944f2721dcf0 # v2.0.1
79+
80+
# SLSA provenance verification using slsa-verifier.
81+
- name: Verify SLSA Provenance
82+
run: |-
83+
set -euo pipefail
84+
slsa-verifier version
85+
slsa-verifier verify-image ${{ inputs.image_digest }} \
86+
--source-uri "github.com/$GITHUB_REPOSITORY" \
87+
--source-tag "$GITHUB_REF_NAME"

0 commit comments

Comments
 (0)