Merge pull request #11 from matusso/binwalk-fix

feat(ci): enhance Docker workflow for multi-architecture builds
matusso · Feb 5, 2025 · ddb888e · ddb888e
2 parents 46f5173 + 7c07c8e
commit ddb888e
Showing 1 changed file with 110 additions and 26 deletions.
diff --git a/.github/workflows/binwalk.yml b/.github/workflows/binwalk.yml
@@ -13,53 +13,111 @@ permissions:
   packages: write  # Required for GitHub Container Registry
   security-events: write
 
-jobs:
-  build-and-push:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-latest]
+env:
+  RELEASE_VERSION: "v3.1.0"
 
+jobs:
+  build-and-push-amd64:
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout ReFirmLabs/binwalk Repository
+        uses: actions/checkout@v4
+        with:
+          repository: ReFirmLabs/binwalk
+          path: binwalk
+          ref: ${{ env.RELEASE_VERSION }}
       - uses: snyk/actions/setup@master
 
-      - name: Set release version
-        id: set_version
-        run: echo "RELEASE_VERSION=v3.1.0" >> $GITHUB_ENV
-
-      - name: Clone binwalk:${{ env.RELEASE_VERSION }}
-        run: |
-          git clone --branch ${{ env.RELEASE_VERSION }} https://github.com/ReFirmLabs/binwalk.git
-
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
       - name: Cache Docker layers
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
-          path: ${{ github.workspace }}/.buildx-cache
-          key: ${{ runner.os }}-buildx-${{ github.sha }}
+          path: ${{ github.workspace }}/.build-cache
+          key: ${{ runner.os }}-build-${{ github.sha }}
           restore-keys: |
-            ${{ runner.os }}-buildx-
+            ${{ runner.os }}-build-
 
       - name: Build and push Docker image to GitHub Container Registry
         run: |
-          docker buildx build --push \
-            --tag ghcr.io/${{ github.repository_owner }}/binwalk:${{ env.RELEASE_VERSION }} \
-            --tag ghcr.io/${{ github.repository_owner }}/binwalk:latest \
-            --platform linux/amd64,linux/arm64 ./binwalk
+          docker build --push --platform linux/amd64 \
+            --tag ghcr.io/${{ github.repository_owner }}/binwalk:${{ env.RELEASE_VERSION }}-amd64 \
+            --tag ghcr.io/${{ github.repository_owner }}/binwalk:latest-amd64 ./binwalk
+          docker push ghcr.io/${{ github.repository_owner }}/binwalk:${{ env.RELEASE_VERSION }}-amd64
+          docker push ghcr.io/${{ github.repository_owner }}/binwalk:latest-amd64
 
       - name: Logout from GitHub Container Registry
         run: docker logout ghcr.io
 
+  build-and-push-arm64:
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - name: Checkout ReFirmLabs/binwalk Repository
+        uses: actions/checkout@v4
+        with:
+          repository: ReFirmLabs/binwalk
+          path: binwalk
+          ref: ${{ env.RELEASE_VERSION }}
+      - uses: snyk/actions/setup@master
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push arm64 Docker image
+        run: |
+          docker build --platform linux/arm64 \
+            --tag ghcr.io/${{ github.repository_owner }}/binwalk:${{ env.RELEASE_VERSION }}-arm64 \
+            --tag ghcr.io/${{ github.repository_owner }}/binwalk:latest-arm64 ./binwalk
+          docker push ghcr.io/${{ github.repository_owner }}/binwalk:${{ env.RELEASE_VERSION }}-arm64
+          docker push ghcr.io/${{ github.repository_owner }}/binwalk:latest-arm64
+
+      - name: Logout from Docker Hub
+        run: docker logout
+
+  create-multiarch-manifest:
+    needs: [build-and-push-amd64, build-and-push-arm64]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create and push multi-platform manifest
+        run: |
+          docker manifest create ghcr.io/${{ github.repository_owner }}/binwalk:${{ env.RELEASE_VERSION }} \
+            --amend ghcr.io/${{ github.repository_owner }}/binwalk:${{ env.RELEASE_VERSION }}-amd64 \
+            --amend ghcr.io/${{ github.repository_owner }}/binwalk:${{ env.RELEASE_VERSION }}-arm64
+          
+          docker manifest create ghcr.io/${{ github.repository_owner }}/binwalk:latest \
+            --amend ghcr.io/${{ github.repository_owner }}/binwalk:latest-amd64 \
+            --amend ghcr.io/${{ github.repository_owner }}/binwalk:latest-arm64
+          
+          docker manifest push ghcr.io/${{ github.repository_owner }}/binwalk:${{ env.RELEASE_VERSION }}
+          docker manifest push ghcr.io/${{ github.repository_owner }}/binwalk:latest
+
+  security-scan:
+    needs: create-multiarch-manifest
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout ReFirmLabs/binwalk Repository
+        uses: actions/checkout@v4
+        with:
+          repository: ReFirmLabs/binwalk
+          path: binwalk
+          ref: ${{ env.RELEASE_VERSION }}
+
       - name: Check ghcr.io/${{ github.repository_owner }}/binwalk:${{ env.RELEASE_VERSION }} image
         uses: snyk/actions/docker@master
         continue-on-error: true
@@ -79,3 +137,29 @@ jobs:
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: snyk.sarif
+
+  sonarcloud-binwalk:
+    needs: create-multiarch-manifest
+    runs-on: ubuntu-latest
+    steps:
+      # Checkout the binwalk  repository
+      - name: Checkout binwalk Repository
+        uses: actions/checkout@v4
+        with:
+          repository: ReFirmLabs/binwalk
+          path: binwalk  # Optional: Clone into a specific directory
+          ref: ${{ env.RELEASE_VERSION }}
+
+      # SonarCloud Scan
+      - name: SonarCloud Scan
+        uses: sonarsource/sonarqube-scan-action@v4
+        continue-on-error: true
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        with:
+          args: >
+            -Dsonar.organization=matusso
+            -Dsonar.projectKey=docker-builds:binwalk
+            -Dsonar.verbose=true
+            -Dsonar.projectName=binwalk
+            -Dsonar.sources=binwalk