Skip to content

Add format support to nvme WipeDisk (#142) #79

Add format support to nvme WipeDisk (#142)

Add format support to nvme WipeDisk (#142) #79

name: release docker image
on:
push:
branches:
- main
tags:
- "v*.*.*"
- "v*.*.*-staging"
jobs:
build:
permissions:
contents: read
packages: write
id-token: write # needed for signing the images with GitHub OIDC Token
runs-on: ubuntu-latest
name: build, release, sign
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Docker meta
id: meta
uses: docker/metadata-action@v5
with:
# list of Docker images to use as base name for tags
images: |
ghcr.io/metal-toolbox/ironlib
# generate Docker tags based on the following events/attributes
tags: |
type=ref,event=branch
type=ref,event=pr
type=semver,pattern={{raw}}
type=sha
- name: install cosign
uses: sigstore/cosign-installer@main
- name: Login to GitHub Container Registry
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Build and Push Images
id: dockerbuild
uses: docker/build-push-action@v5
with:
provenance: false
context: .
push: true
tags: ${{ steps.meta.outputs.tags }}
platforms: linux/amd64,linux/arm64
- name: Scan image
id: scan
uses: anchore/scan-action@v3
with:
image: ghcr.io/metal-toolbox/ironlib@${{ steps.dockerbuild.outputs.digest }}
acs-report-enable: true
# TODO(jaosorior): Fail build once we migrate off CentOS.
fail-build: false
- name: Sign the images with GitHub OIDC Token
run: cosign sign --recursive --yes ghcr.io/metal-toolbox/ironlib@${{ steps.dockerbuild.outputs.digest }}
env:
COSIGN_EXPERIMENTAL: true
- uses: anchore/sbom-action/[email protected]
# TODO(jaosorior): Uncomment once we migrate off CentOS.
# - name: upload Anchore scan SARIF report
# uses: github/codeql-action/upload-sarif@v2
# with:
# sarif_file: ${{ steps.scan.outputs.sarif }}
# # This should run even if we fail the container scan
# if: always()
- name: Inspect action SARIF report
run: cat ${{ steps.scan.outputs.sarif }}
# This should run even if we fail the container scan
if: always()