-
Notifications
You must be signed in to change notification settings - Fork 99
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
✨ Move Earthly logic into Dockerfiles (#2008)
* Add framework files and generate os-release Signed-off-by: Mauro Morales <[email protected]> * Install provider and k3s Plus clean at the end Signed-off-by: Mauro Morales <[email protected]> * Fix os-release names Signed-off-by: Mauro Morales <[email protected]> * Use no-base-image on Earthly as a first step Signed-off-by: Mauro Morales <[email protected]> * Fix KAIROS_VERSION calculation Signed-off-by: Mauro Morales <[email protected]> * Move logic for alpine Signed-off-by: Mauro Morales <[email protected]> * Move logic for opensuse Signed-off-by: Mauro Morales <[email protected]> * Lint Signed-off-by: Mauro Morales <[email protected]> * Add debian & rhel Signed-off-by: Mauro Morales <[email protected]> * Fix ubuntu arm generic Signed-off-by: Mauro Morales <[email protected]> * Framework changes and luet versions Signed-off-by: Mauro Morales <[email protected]> * hadolint Signed-off-by: Mauro Morales <[email protected]> * yamllint Signed-off-by: Mauro Morales <[email protected]> * test building nvidia on pr Signed-off-by: Mauro Morales <[email protected]> * fix push Signed-off-by: Mauro Morales <[email protected]> * fix path Signed-off-by: Mauro Morales <[email protected]> * use quay Signed-off-by: Mauro Morales <[email protected]> * login quay Signed-off-by: Mauro Morales <[email protected]> * 🤦 Signed-off-by: Mauro Morales <[email protected]> * define the nvidia jetson strategy in the ubuntu file Signed-off-by: Mauro Morales <[email protected]> * Only run build of nvidia if dockerfile changed Signed-off-by: Mauro Morales <[email protected]> * same for all other steps Signed-off-by: Mauro Morales <[email protected]> * No need to push latest Signed-off-by: Mauro Morales <[email protected]> * process nvidia on master and release Signed-off-by: Mauro Morales <[email protected]> * remove no-base-image Signed-off-by: Mauro Morales <[email protected]> * extract kairos common & remove non-hwe Signed-off-by: Mauro Morales <[email protected]> * Remove Dockerfile.kairos-* Signed-off-by: Mauro Morales <[email protected]> * hadolint Signed-off-by: Mauro Morales <[email protected]> * forgot to remove this section on debian Signed-off-by: Mauro Morales <[email protected]> * move non-hwe to examples Signed-off-by: Mauro Morales <[email protected]> * feedback Signed-off-by: Mauro Morales <[email protected]> * add name generation for base-images Signed-off-by: Mauro Morales <[email protected]> * shoot Signed-off-by: Mauro Morales <[email protected]> * lint Signed-off-by: Mauro Morales <[email protected]> * oops Signed-off-by: Mauro Morales <[email protected]> --------- Signed-off-by: Mauro Morales <[email protected]>
- Loading branch information
1 parent
631b7c7
commit 84f1eaa
Showing
24 changed files
with
1,677 additions
and
310 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| build/*iso | ||
| build/* | ||
| # this is created by the strat_vm_qemu.sh script | ||
| disk.img | ||
| *.img | ||
| *.raw |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -68,26 +68,34 @@ jobs: | |
| echo | ||
| sudo rm -rfv build || true | ||
| df -h | ||
| - name: Block all traffic to metadata ip # For cloud runners, the metadata ip can interact with our test machines | ||
| run: | | ||
| sudo iptables -I INPUT -s 169.254.169.254 -j DROP | ||
| sudo iptables -I OUTPUT -d 169.254.169.254 -j DROP | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@master | ||
| with: | ||
| platforms: all | ||
| - name: Login to Quay Registry | ||
| if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }} | ||
| run: echo ${{ secrets.QUAY_PASSWORD }} | docker login -u ${{ secrets.QUAY_USERNAME }} --password-stdin quay.io | ||
| - name: Install Cosign | ||
| uses: sigstore/cosign-installer@main | ||
| - name: Set up Docker Buildx | ||
| id: buildx | ||
| uses: docker/setup-buildx-action@master | ||
| - name: Install earthly | ||
| uses: Luet-lab/[email protected] | ||
| with: | ||
| repository: quay.io/kairos/packages | ||
| packages: utils/earthly | ||
| - name: Set up Docker Buildx | ||
| id: buildx | ||
| uses: docker/setup-buildx-action@master | ||
| - name: Login to Quay Registry | ||
| if: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v')) }} | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| registry: quay.io | ||
| username: ${{ secrets.QUAY_USERNAME }} | ||
| password: ${{ secrets.QUAY_PASSWORD }} | ||
| - name: Set compression for PR | ||
| if: ${{ github.event_name == 'pull_request' }} | ||
| run: | | ||
|
|
@@ -96,31 +104,66 @@ jobs: | |
| if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }} | ||
| run: | | ||
| echo "IMG_COMPRESSION=xz" >> $GITHUB_ENV | ||
| - name: Block all traffic to metadata ip # For cloud runners, the metadata ip can interact with our test machines | ||
| run: | | ||
| sudo iptables -I INPUT -s 169.254.169.254 -j DROP | ||
| sudo iptables -I OUTPUT -d 169.254.169.254 -j DROP | ||
| - name: Build 🔧 | ||
| run: | | ||
| earthly --allow-privileged +all-arm \ | ||
| --FAMILY=${{ inputs.family }} \ | ||
| earthly -P +all-arm \ | ||
| --VARIANT=core \ | ||
| --MODEL=${{ inputs.model }} \ | ||
| --FLAVOR=${{ inputs.flavor }} \ | ||
| --FLAVOR_RELEASE=${{ inputs.flavor_release }} \ | ||
| --FAMILY=${{ inputs.family }} \ | ||
| --BASE_IMAGE=${{ inputs.base_image }} \ | ||
| --MODEL=${{ inputs.model }} \ | ||
| --VARIANT=core \ | ||
| --IMG_COMPRESSION=${{env.IMG_COMPRESSION}} | ||
| - name: Show img sizes | ||
| run: | | ||
| ls -ltra build | ||
| ls -ltrh build | ||
| - name: Convert all json files into a reports.tar.gz file | ||
| if: startsWith(github.ref, 'refs/tags/v') | ||
| run: | | ||
| export VERSION=$(cat build/VERSION) | ||
| cd build | ||
| filename=$(ls *-grype.json | head -n 1) && filename=${filename%%-grype.json} | ||
| sudo tar cvf "${filename}-scan-reports.tar.gz" *.json | ||
| - name: Push 🔧 | ||
| if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }} | ||
| if: startsWith(github.ref, 'refs/tags/v') | ||
| run: | | ||
| docker push $(cat build/IMAGE) | ||
| - name: Sign image | ||
| if: startsWith(github.ref, 'refs/tags/v') | ||
| env: | ||
| COSIGN_YES: true | ||
| run: | | ||
| export IMAGE=$(cat build/IMAGE) | ||
| docker push "$IMAGE" # Otherwise .RepoDigests will be empty for some reason | ||
| cosign sign $(docker image inspect --format='{{index .RepoDigests 0}}' "$IMAGE") | ||
| - name: Upload Image | ||
| if: startsWith(github.ref, 'refs/tags/v') | ||
| run: | | ||
| curl https://luet.io/install.sh | sudo sh | ||
| IMAGE=$(cat build/IMAGE | sed 's/$/-img/') | ||
| sudo tar cvf build.tar build | ||
| sudo luet util pack $IMAGE build.tar image.tar | ||
| sudo -E docker load -i image.tar | ||
| sudo -E docker push "$IMAGE" | ||
| sudo rm -rf build/IMAGE build/VERSION | ||
| - name: Release | ||
| if: startsWith(github.ref, 'refs/tags/v') | ||
| uses: softprops/action-gh-release@v1 | ||
| with: | ||
| files: | | ||
| build/*scan-reports.tar.gz | ||
| - name: Prepare sarif files 🔧 | ||
| if: startsWith(github.ref, 'refs/tags/v') | ||
| run: | | ||
| export _IMG=$(cat build/IMAGE) | ||
| export _NEW_IMG=$(echo $_IMG | cut -f1 -d:):latest | ||
| docker tag $_IMG $_NEW_IMG | ||
| docker push $_NEW_IMG | ||
| mkdir sarif | ||
| sudo mv build/*.sarif sarif/ | ||
| - name: Upload Trivy scan results to GitHub Security tab | ||
| uses: github/codeql-action/upload-sarif@v2 | ||
| if: startsWith(github.ref, 'refs/tags/v') | ||
| with: | ||
| sarif_file: 'sarif' | ||
| category: ${{ matrix.flavor }} | ||
| - name: Prepare sarif files 🔧 | ||
| if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }} | ||
| run: | | ||
|
|
@@ -132,21 +175,8 @@ jobs: | |
| with: | ||
| sarif_file: 'sarif' | ||
| category: ${{ inputs.flavor }} | ||
| - name: Sign image | ||
| if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }} | ||
| run: | | ||
| # Avoid pushing a new image for every commit (re-use latest) | ||
| export _IMG=$(cat build/IMAGE) | ||
| export _LATEST=$(echo $_IMG | cut -f1 -d:):latest | ||
| docker push $_LATEST | ||
| image_ref=$(docker image inspect --format='{{index .RepoDigests 0}}' "$_LATEST") | ||
| spdx=$(ls build/*.spdx.json) | ||
| cosign attach sbom --sbom $spdx $image_ref | ||
| cosign sign -y $image_ref --attachment sbom | ||
| # in-toto attestation | ||
| cosign attest -y --type spdx --predicate $spdx $image_ref | ||
| - name: Upload results | ||
| if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.flavor != 'ubuntu-20-lts-arm-nvidia-jetson-agx-orin' }} | ||
| if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.model != 'nvidia-jetson-agx-orin' }} | ||
| uses: actions/upload-artifact@v3 | ||
| with: | ||
| name: ${{ inputs.flavor }}-image | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.