Build and Push Container #64
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| postgres-major-version: | |
| description: "Postgres major version to release." | |
| type: string | |
| required: true | |
| services: | |
| description: "Json list with postgres services to upgrade." | |
| type: string | |
| required: true | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| pull-requests: write | |
| jobs: | |
| push-postgres: | |
| runs-on: self-hosted-generic | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Get dockerhub postgres service tags | |
| id: dtags | |
| uses: greenbone/actions/oci-info@v3 | |
| with: | |
| repository: postgres | |
| namespace: library | |
| reg-domain: registry-1.docker.io | |
| reg-auth-domain: auth.docker.io | |
| reg-auth-service: registry.docker.io | |
| - name: Increment opensight-postgres service version | |
| id: version | |
| shell: bash | |
| run: | | |
| # Get latest minor version from dockerhub | |
| dt="$(echo -e '${{ steps.dtags.outputs.output }}' | grep -E '${{ inputs.postgres-major-version }}.[0-9]+$' | sort -Vr | sed q)" | |
| if ! [ "$dt" ]; then | |
| echo "No minor found!" | |
| exit 1 | |
| fi | |
| IFS='.' read -r -a dv <<< "$dt" | |
| minor="${dv[1]}" | |
| echo "output=${{ inputs.postgres-major-version }}.$minor.0" >> $GITHUB_OUTPUT | |
| - name: Build and Push Greenbone Registry | |
| id: build-greenbone | |
| uses: greenbone/actions/container-build-push-generic@v3 | |
| with: | |
| build-args: "POSTGRES_VERSION=${{ inputs.postgres-major-version }}" | |
| cosign-key: ${{ secrets.COSIGN_KEY_OPENSIGHT }} | |
| cosign-key-password: ${{ secrets.COSIGN_KEY_PASSWORD_OPENSIGHT }} | |
| cosign-tlog-upload: "false" | |
| image-url: opensight/opensight-postgres | |
| image-labels: | | |
| org.opencontainers.image.vendor=Greenbone | |
| org.opencontainers.image.base.name=postgres:${{ inputs.postgres-major-version }} | |
| image-tags: | | |
| type=raw,value=${{ inputs.postgres-major-version }} | |
| type=raw,value=${{ steps.version.outputs.output }} | |
| registry: ${{ vars.GREENBONE_REGISTRY }} | |
| registry-username: ${{ secrets.GREENBONE_REGISTRY_USER }} | |
| registry-password: ${{ secrets.GREENBONE_REGISTRY_TOKEN }} | |
| # For whatever reason, the native buildx doesn't build annotations! | |
| buildx-container: 'true' | |
| # Remove after switch to greenbone registry | |
| - name: Build and Push | |
| id: build | |
| uses: greenbone/actions/container-build-push-generic@v3 | |
| with: | |
| build-args: "POSTGRES_VERSION=${{ inputs.postgres-major-version }}" | |
| cosign-key: ${{ secrets.COSIGN_KEY_OPENSIGHT }} | |
| cosign-key-password: ${{ secrets.COSIGN_KEY_PASSWORD_OPENSIGHT }} | |
| cosign-tlog-upload: "false" | |
| image-url: ${{ github.repository }} | |
| image-labels: | | |
| org.opencontainers.image.vendor=Greenbone | |
| org.opencontainers.image.base.name=postgres:${{ inputs.postgres-major-version }} | |
| image-tags: | | |
| type=raw,value=${{ inputs.postgres-major-version }} | |
| type=raw,value=${{ steps.version.outputs.output }} | |
| registry: ${{ vars.IMAGE_REGISTRY }} | |
| registry-username: ${{ github.actor }} | |
| registry-password: ${{ secrets.GITHUB_TOKEN }} | |
| # For whatever reason, the native buildx doesn't build annotations! | |
| buildx-container: 'true' | |
| # After switch to greenbone registry change digest and image-url | |
| - name: Service upgrade matrix | |
| id: upgrade | |
| run: | | |
| echo "matrix=$(echo '${{ inputs.services }}' | jq -r '{include:[.[] | {service: ., "image-url": "${{ github.repository }}", digest: "${{ steps.build.outputs.digest }}", version: "${{ steps.version.outputs.output }}" }]} | @json')" >> $GITHUB_OUTPUT | |
| outputs: | |
| matrix: ${{ steps.upgrade.outputs.matrix }} | |
| push-service: | |
| needs: push-postgres | |
| if: ${{ needs.push-postgres.outputs.matrix }} | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| # We have to run one workflow after the other here | |
| # because our product compose Construction Process cannot handle multiple processes. | |
| max-parallel: 1 | |
| matrix: ${{ fromJSON(needs.push-postgres.outputs.matrix) }} | |
| steps: | |
| - name: Trigger product compose upgrade | |
| uses: greenbone/actions/trigger-workflow@v3 | |
| with: | |
| token: ${{ secrets.GREENBONE_BOT_TOKEN }} | |
| repository: "greenbone/automatix" | |
| workflow: "push.yml" | |
| inputs: '{"service": "${{ matrix.service }}", "image-url": "${{ matrix.image-url }}", "digest": "${{ matrix.digest }}", "version": "${{ matrix.version }}"}' | |
| notify: | |
| needs: | |
| - push-postgres | |
| - push-service | |
| if: ${{ !cancelled() }} | |
| uses: greenbone/workflows/.github/workflows/notify-mattermost-3rd-gen.yml@main | |
| with: | |
| status: ${{ contains(needs.*.result, 'failure') && 'failure' || 'success' }} | |
| secrets: inherit |