Skip to content

Commit 2bae363

Browse files
crazy-maxcrazy-max
committed
verify reusable workflow
Signed-off-by: CrazyMax <[email protected]>
1 parent d918096 commit 2bae363

File tree

5 files changed

+180
-148
lines changed

5 files changed

+180
-148
lines changed

‎.github/workflows/.test.yml‎

Lines changed: 85 additions & 104 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,19 @@ jobs:
3939
username: ${{ secrets.AWS_ACCESS_KEY_ID }}
4040
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
4141
42+
build-aws-single-verify:
43+
uses: ./.github/workflows/verify.yml
44+
if: ${{ github.event_name != 'pull_request' }}
45+
needs:
46+
- build-aws-single
47+
with:
48+
builder-outputs: ${{ toJSON(needs.build-aws-single.outputs) }}
49+
secrets:
50+
registry-auths: |
51+
- registry: public.ecr.aws
52+
username: ${{ secrets.AWS_ACCESS_KEY_ID }}
53+
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
54+
4255
build-aws:
4356
uses: ./.github/workflows/build.yml
4457
permissions:
@@ -63,37 +76,17 @@ jobs:
6376
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
6477
6578
build-aws-verify:
66-
runs-on: ubuntu-latest
79+
uses: ./.github/workflows/verify.yml
6780
if: ${{ github.event_name != 'pull_request' }}
6881
needs:
6982
- build-aws
70-
steps:
71-
-
72-
name: Install Cosign
73-
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
74-
with:
75-
cosign-release: ${{ needs.build-aws.outputs.cosign-version }}
76-
-
77-
name: Login to registry
78-
uses: docker/login-action@v3
79-
with:
80-
registry: public.ecr.aws
83+
with:
84+
builder-outputs: ${{ toJSON(needs.build-aws.outputs) }}
85+
secrets:
86+
registry-auths: |
87+
- registry: public.ecr.aws
8188
username: ${{ secrets.AWS_ACCESS_KEY_ID }}
8289
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
83-
-
84-
name: Verify signatures
85-
uses: actions/github-script@v8
86-
env:
87-
INPUT_COSIGN-VERSION: ${{ needs.build-aws.outputs.cosign-version }}
88-
INPUT_COSIGN-VERIFY-COMMANDS: ${{ needs.build-aws.outputs.cosign-verify-commands }}
89-
with:
90-
script: |
91-
const cosignVersion = core.getInput('cosign-version');
92-
core.info(`Cosign version used by Docker GitHub Builder: ${cosignVersion}`);
93-
const cosignVerifyCommands = core.getMultilineInput('cosign-verify-commands');
94-
for (const cmd of cosignVerifyCommands) {
95-
await exec.exec(cmd);
96-
}
9790
9891
build-ghcr:
9992
uses: ./.github/workflows/build.yml
@@ -115,6 +108,19 @@ jobs:
115108
username: ${{ github.actor }}
116109
password: ${{ secrets.GITHUB_TOKEN }}
117110
111+
build-ghcr-verify:
112+
uses: ./.github/workflows/verify.yml
113+
if: ${{ github.event_name != 'pull_request' }}
114+
needs:
115+
- build-ghcr
116+
with:
117+
builder-outputs: ${{ toJSON(needs.build-ghcr.outputs) }}
118+
secrets:
119+
registry-auths: |
120+
- registry: ghcr.io
121+
username: ${{ github.actor }}
122+
password: ${{ secrets.GITHUB_TOKEN }}
123+
118124
build-dockerhub-stage:
119125
uses: ./.github/workflows/build.yml
120126
permissions:
@@ -135,6 +141,19 @@ jobs:
135141
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
136142
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}
137143
144+
build-dockerhub-stage-verify:
145+
uses: ./.github/workflows/verify.yml
146+
if: ${{ github.event_name != 'pull_request' }}
147+
needs:
148+
- build-dockerhub-stage
149+
with:
150+
builder-outputs: ${{ toJSON(needs.build-dockerhub-stage.outputs) }}
151+
secrets:
152+
registry-auths: |
153+
- registry: registry-1-stage.docker.io
154+
username: ${{ vars.DOCKERHUB_STAGE_USERNAME }}
155+
password: ${{ secrets.DOCKERHUB_STAGE_TOKEN }}
156+
138157
build-dockerhub-stage-oidc:
139158
uses: ./.github/workflows/build.yml
140159
permissions:
@@ -154,6 +173,18 @@ jobs:
154173
- registry: registry-1-stage.docker.io
155174
username: docker:cdeb5882-30b7-4076-be92-bfdceb258e9c
156175
176+
build-dockerhub-stage-oidc-verify:
177+
uses: ./.github/workflows/verify.yml
178+
if: ${{ github.event_name != 'pull_request' }}
179+
needs:
180+
- build-dockerhub-stage-oidc
181+
with:
182+
builder-outputs: ${{ toJSON(needs.build-dockerhub-stage-oidc.outputs) }}
183+
secrets:
184+
registry-auths: |
185+
- registry: registry-1-stage.docker.io
186+
username: docker:cdeb5882-30b7-4076-be92-bfdceb258e9c
187+
157188
build-ghcr-and-aws:
158189
uses: ./.github/workflows/build.yml
159190
permissions:
@@ -179,6 +210,22 @@ jobs:
179210
username: ${{ secrets.AWS_ACCESS_KEY_ID }}
180211
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
181212
213+
build-ghcr-and-aws-verify:
214+
uses: ./.github/workflows/verify.yml
215+
if: ${{ github.event_name != 'pull_request' }}
216+
needs:
217+
- build-ghcr-and-aws
218+
with:
219+
builder-outputs: ${{ toJSON(needs.build-ghcr-and-aws.outputs) }}
220+
secrets:
221+
registry-auths: |
222+
- registry: ghcr.io
223+
username: ${{ github.actor }}
224+
password: ${{ secrets.GITHUB_TOKEN }}
225+
- registry: public.ecr.aws
226+
username: ${{ secrets.AWS_ACCESS_KEY_ID }}
227+
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
228+
182229
build-local:
183230
uses: ./.github/workflows/build.yml
184231
permissions:
@@ -193,35 +240,12 @@ jobs:
193240
build-platforms: linux/amd64,linux/arm64
194241

195242
build-local-verify:
196-
runs-on: ubuntu-latest
243+
uses: ./.github/workflows/verify.yml
197244
if: ${{ github.event_name != 'pull_request' }}
198245
needs:
199246
- build-local
200-
steps:
201-
-
202-
name: Install Cosign
203-
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
204-
with:
205-
cosign-release: ${{ needs.build-local.outputs.cosign-version }}
206-
-
207-
name: Download artifact
208-
uses: actions/download-artifact@v5
209-
with:
210-
name: ${{ needs.build-local.outputs.artifact-name }}
211-
-
212-
name: Verify signatures
213-
uses: actions/github-script@v8
214-
env:
215-
INPUT_COSIGN-VERSION: ${{ needs.build-local.outputs.cosign-version }}
216-
INPUT_COSIGN-VERIFY-COMMANDS: ${{ needs.build-local.outputs.cosign-verify-commands }}
217-
with:
218-
script: |
219-
const cosignVersion = core.getInput('cosign-version');
220-
core.info(`Cosign version used by Docker GitHub Builder: ${cosignVersion}`);
221-
const cosignVerifyCommands = core.getMultilineInput('cosign-verify-commands');
222-
for (const cmd of cosignVerifyCommands) {
223-
await exec.exec(cmd);
224-
}
247+
with:
248+
builder-outputs: ${{ toJSON(needs.build-local.outputs) }}
225249

226250
bake-aws:
227251
uses: ./.github/workflows/bake.yml
@@ -247,37 +271,17 @@ jobs:
247271
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
248272
249273
bake-aws-verify:
250-
runs-on: ubuntu-latest
274+
uses: ./.github/workflows/verify.yml
251275
if: ${{ github.event_name != 'pull_request' }}
252276
needs:
253277
- bake-aws
254-
steps:
255-
-
256-
name: Install Cosign
257-
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
258-
with:
259-
cosign-release: ${{ needs.bake-aws.outputs.cosign-version }}
260-
-
261-
name: Login to registry
262-
uses: docker/login-action@v3
263-
with:
264-
registry: public.ecr.aws
278+
with:
279+
builder-outputs: ${{ toJSON(needs.bake-aws.outputs) }}
280+
secrets:
281+
registry-auths: |
282+
- registry: public.ecr.aws
265283
username: ${{ secrets.AWS_ACCESS_KEY_ID }}
266284
password: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
267-
-
268-
name: Verify signatures
269-
uses: actions/github-script@v8
270-
env:
271-
INPUT_COSIGN-VERSION: ${{ needs.bake-aws.outputs.cosign-version }}
272-
INPUT_COSIGN-VERIFY-COMMANDS: ${{ needs.bake-aws.outputs.cosign-verify-commands }}
273-
with:
274-
script: |
275-
const cosignVersion = core.getInput('cosign-version');
276-
core.info(`Cosign version used by Docker GitHub Builder: ${cosignVersion}`);
277-
const cosignVerifyCommands = core.getMultilineInput('cosign-verify-commands');
278-
for (const cmd of cosignVerifyCommands) {
279-
await exec.exec(cmd);
280-
}
281285
282286
bake-local:
283287
uses: ./.github/workflows/bake.yml
@@ -294,32 +298,9 @@ jobs:
294298
bake-sbom: true
295299

296300
bake-local-verify:
297-
runs-on: ubuntu-latest
301+
uses: ./.github/workflows/verify.yml
298302
if: ${{ github.event_name != 'pull_request' }}
299303
needs:
300304
- bake-local
301-
steps:
302-
-
303-
name: Install Cosign
304-
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
305-
with:
306-
cosign-release: ${{ needs.bake-local.outputs.cosign-version }}
307-
-
308-
name: Download artifact
309-
uses: actions/download-artifact@v5
310-
with:
311-
name: ${{ needs.bake-local.outputs.artifact-name }}
312-
-
313-
name: Verify signatures
314-
uses: actions/github-script@v8
315-
env:
316-
INPUT_COSIGN-VERSION: ${{ needs.bake-local.outputs.cosign-version }}
317-
INPUT_COSIGN-VERIFY-COMMANDS: ${{ needs.bake-local.outputs.cosign-verify-commands }}
318-
with:
319-
script: |
320-
const cosignVersion = core.getInput('cosign-version');
321-
core.info(`Cosign version used by Docker GitHub Builder: ${cosignVersion}`);
322-
const cosignVerifyCommands = core.getMultilineInput('cosign-verify-commands');
323-
for (const cmd of cosignVerifyCommands) {
324-
await exec.exec(cmd);
325-
}
305+
with:
306+
builder-outputs: ${{ toJSON(needs.bake-local.outputs) }}

‎.github/workflows/bake.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,9 @@ on:
125125
artifact-name:
126126
description: Name of the uploaded artifact (for local output)
127127
value: ${{ jobs.build.outputs.artifact-name }}
128+
output-type:
129+
description: Build output type
130+
value: ${{ jobs.build.outputs.output-type }}
128131

129132
env:
130133
DOCKER_ACTIONS_TOOLKIT_MODULE: "@docker/[email protected]"
@@ -138,6 +141,7 @@ jobs:
138141
cosign-version: ${{ env.COSIGN_VERSION }}
139142
cosign-verify-commands: ${{ steps.signing-attestation-manifests.outputs.verify-commands || steps.signing-local-artifacts.outputs.verify-commands }}
140143
artifact-name: ${{ inputs.artifact-name }}
144+
output-type: ${{ inputs.output }}
141145
permissions:
142146
contents: read
143147
id-token: write # needed for signing the images with GitHub OIDC Token

‎.github/workflows/build.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,9 @@ on:
127127
artifact-name:
128128
description: Name of the uploaded artifact (for local output)
129129
value: ${{ jobs.build.outputs.artifact-name }}
130+
output-type:
131+
description: Build output type
132+
value: ${{ jobs.build.outputs.output-type }}
130133

131134
env:
132135
DOCKER_ACTIONS_TOOLKIT_MODULE: "@docker/[email protected]"
@@ -140,6 +143,7 @@ jobs:
140143
cosign-version: ${{ env.COSIGN_VERSION }}
141144
cosign-verify-commands: ${{ steps.signing-attestation-manifests.outputs.verify-commands || steps.signing-local-artifacts.outputs.verify-commands }}
142145
artifact-name: ${{ inputs.artifact-name }}
146+
output-type: ${{ inputs.output }}
143147
permissions:
144148
contents: read
145149
id-token: write # needed for signing the images with GitHub OIDC Token

‎.github/workflows/verify.yml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
name: verify
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
builder-outputs:
7+
type: string
8+
description: "JSON build outputs from Docker GitHub Builder reusable workflows"
9+
required: true
10+
secrets:
11+
registry-auths:
12+
description: "Registry authentication details as YAML objects"
13+
required: false
14+
15+
jobs:
16+
verify:
17+
runs-on: ubuntu-latest
18+
steps:
19+
-
20+
name: Extract builder outputs
21+
id: vars
22+
uses: actions/github-script@v8
23+
env:
24+
INPUT_BUILDER-OUTPUTS: ${{ inputs.builder-outputs }}
25+
with:
26+
script: |
27+
const builderOutputs = JSON.parse(core.getInput('builder-outputs'));
28+
core.info(JSON.stringify(builderOutputs, null, 2));
29+
30+
const cosignVersion = builderOutputs['cosign-version'];
31+
const cosignVerifyCommands = builderOutputs['cosign-verify-commands'];
32+
const artifactName = builderOutputs['artifact-name'];
33+
const outputType = builderOutputs['output-type'];
34+
if (!cosignVersion || !cosignVerifyCommands || !artifactName || !outputType) {
35+
throw new Error('Missing required build outputs for verification');
36+
}
37+
38+
core.setOutput('cosign-version', cosignVersion);
39+
core.setOutput('cosign-verify-commands', cosignVerifyCommands);
40+
core.setOutput('artifact-name', artifactName);
41+
core.setOutput('output-type', outputType);
42+
-
43+
name: Install Cosign
44+
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
45+
with:
46+
cosign-release: ${{ steps.vars.outputs.cosign-version }}
47+
-
48+
name: Login to registry
49+
if: ${{ steps.vars.outputs.output-type == 'registry' }}
50+
# TODO: switch to docker/login-action when OIDC is supported
51+
uses: crazy-max/docker-login-action@dockerhub-oidc
52+
with:
53+
registry-auth: ${{ secrets.registry-auths }}
54+
-
55+
name: Download artifact
56+
if: ${{ steps.vars.outputs.output-type == 'artifact' }}
57+
uses: actions/download-artifact@v5
58+
with:
59+
name: ${{ steps.vars.outputs.artifact-name }}
60+
-
61+
name: Verify signatures
62+
uses: actions/github-script@v8
63+
env:
64+
INPUT_COSIGN-VERIFY-COMMANDS: ${{ steps.vars.outputs.cosign-verify-commands }}
65+
with:
66+
script: |
67+
for (const cmd of core.getMultilineInput('cosign-verify-commands')) {
68+
await exec.exec(cmd);
69+
}

0 commit comments

Comments
 (0)