From 1e2d1f5010e72c3280c6cfa76b50700b681e1008 Mon Sep 17 00:00:00 2001
From: Peefy <xpf6677@163.com>
Date: Thu, 24 Oct 2024 19:47:13 +0800
Subject: [PATCH] refactor: image release

Signed-off-by: Peefy <xpf6677@163.com>
---
 .github/workflows/release.yaml | 107 ++++++++++-----------------------
 Dockerfile                     |  29 ++++-----
 2 files changed, 44 insertions(+), 92 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index c259a7c..2fb83e0 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -2,52 +2,20 @@
 # https://goreleaser.com/ci/actions/
 name: Release
 on:
+  pull_request:
+    branches:
+     - main
   push:
-    tags:
-      - "v*"
+    branches:
+     - main
 permissions:
   contents: write
 jobs:
-  image-amd64:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-
-      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          version: v0.11.2
-          install: true
-
-      # <--- Login, build and push image to Docker Hub --->
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: kcllang/kcl
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          platforms: linux/amd64
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-
-  image-arm64:
+  image:
+    outputs:
+      hashes: ${{ steps.hash.outputs.hashes }}
+      image_url: ${{ steps.hash.outputs.image_url }}
+      image_digest: ${{ steps.hash.outputs.image_digest }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -61,51 +29,38 @@ jobs:
 
       - name: Setup QEMU
         uses: docker/setup-qemu-action@v3
-        with:
-          platforms: all
       - name: Setup Docker Buildx
         uses: docker/setup-buildx-action@v3
+      - name: Docker login ghcr.io
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
-          version: v0.11.2
-          install: true
-  
-      # <--- Login, build and push image to Docker Hub --->
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
+          registry: ghcr.io
+          username: kclbot
+          password: ${{ secrets.DEPLOY_ACCESS_TOKEN }}
+      - name: Docker login docker.io
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Extract metadata (tags, labels) for Docker
+      - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
         with:
-          images: kcllang/kcl-arm64
+          images: |
+            kcllang/kcl
+            ghcr.io/kcl-lang/kcl
+          tags: |
+            type=raw,value=${{ steps.prep.outputs.version }}
+
       - name: Build and push Docker image
         uses: docker/build-push-action@v6
         with:
+          sbom: true
+          provenance: true
+          push: true
+          builder: ${{ steps.buildx.outputs.name }}
           context: .
-          platforms: linux/arm64
-          push: ${{ github.event_name != 'pull_request' }}
+          file: ./Dockerfile
+          platforms: linux/amd64,linux/arm/v7,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-
-  binary:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v5
-        with:
-          distribution: goreleaser
-          version: latest
-          args: release --clean
-        env:
-          GITHUB_TOKEN: ${{ secrets.DEPLOY_ACCESS_TOKEN }}
diff --git a/Dockerfile b/Dockerfile
index 2f8fd45..e87491f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,26 +9,23 @@ WORKDIR /src
 ARG TARGETOS
 ARG TARGETARCH
 
-ENV CGO_ENABLED=0
+ENV CGO_ENABLED 0
 
 RUN --mount=type=cache,target=/go/pkg --mount=type=cache,target=/root/.cache/go-build GOOS=${TARGETOS} GOARCH=${TARGETARCH} make build
 
-FROM --platform=${BUILDPLATFORM} ubuntu:22.04 AS base
-ENV LANG=en_US.utf8
-
-FROM base
-
-ARG TARGETARCH
+FROM gcr.io/distroless/base-debian11 AS image
 
 COPY --from=build /src/bin/kcl /usr/local/bin/kcl
-RUN /usr/local/bin/kcl
-RUN apt-get update && apt-get install make gcc git -y && rm -rf /var/lib/apt/lists/*
+# Show KCL version
+RUN /src/bin/kcl version
+# Enable kcl works fine
+RUN echo 'a=1' | kcl run -
+# Install Git Dependency
+RUN apt-get update && apt-get install git -y && rm -rf /var/lib/apt/lists/*
 # The reason for doing this below is to prevent the
 # container from not having write permissions.
-ENV KCL_LIB_HOME=/tmp
-ENV KCL_PKG_PATH=/tmp
-ENV KCL_CACHE_PATH=/tmp
-# Install the tini
-ENV TINI_VERSION v0.19.0
-ADD https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini-${TARGETARCH} /tini
-RUN chmod +x /tini
+ENV KCL_LIB_HOME /tmp
+ENV KCL_PKG_PATH /tmp
+ENV KCL_CACHE_PATH /tmp
+ENV LANG en_US.utf8
+USER nonroot:nonroot