ci: use docker actions

getchoo-archive · Jan 25, 2024 · fd72f39 · fd72f39
1 parent 1157c04
commit fd72f39
Show file tree

Hide file tree

Showing 5 changed files with 41 additions and 42 deletions.
diff --git a/.github/workflows/build-image.yaml b/.github/workflows/build-image.yaml
@@ -32,19 +32,22 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Extract metadata
         id: metadata
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@dbef88086f6cef02e264edb7dbf63250c17cef6c # v5.5.0
         with:
-          images: |
-            ${{ env.IMAGE_NAME }}
+          images: ${{ env.REGISTRY }}/${{ inputs.image_name }}
           tags: |
             type=sha
             type=ref,event=branch
             type=ref,event=pr
             type=schedule,pattern={{date 'YYYYMMDD'}}
+            ${{ inputs.extra_tags }}
+
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
 
       - name: Get akmods signing key
         if: github.event_name != 'pull_request'
@@ -53,52 +56,39 @@ jobs:
         run: |
           echo "$AKMODS_KEY" > akmods/certs/private_key.priv
 
-      - name: Build image
-        id: build
-        uses: redhat-actions/buildah-build@v2
-        with:
-          containerfiles: |
-            ${{ inputs.containerfile }}
-          image: ${{ inputs.image_name }}
-          context: ${{ inputs.context }}
-          tags: |
-            ${{ steps.metadata.outputs.tags }}
-            ${{ inputs.extra_tags }}
-          labels: ${{ steps.metadata.outputs.labels }}
-          build-args: ${{ inputs.build_args }}
-
       - name: Login to registry
         if: github.event_name != 'pull_request'
-        uses: redhat-actions/podman-login@v1
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ github.token }}
 
-      - name: Push to registry
-        id: push
-        if: github.event_name != 'pull_request'
-        uses: redhat-actions/push-to-registry@v2
+      - name: Build image
+        id: build
+        uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0
         with:
-          image: ${{ steps.build.outputs.image }}
-          tags: ${{ steps.build.outputs.tags }}
-          registry: ${{ env.REGISTRY }}
-          extra-args: |
-            --disable-content-trust
+          context: ${{ inputs.context }}
+          file: ${{ inputs.containerfile }}
+          tags: ${{ steps.metadata.outputs.tags }}
+          labels: ${{ steps.metadata.outputs.labels }}
+          build-args: ${{ inputs.build_args }}
+          push: ${{ github.event_name != 'pull_request' }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
 
       - name: Install cosign
         if: github.event_name != 'pull_request'
-        uses: sigstore/cosign-installer@v3
+        uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0
 
       - name: Sign image
         if: github.event_name != 'pull_request'
         env:
-          DIGEST: ${{ steps.push.outputs.digest }}
-          TAGS: ${{ steps.build.outputs.tags }}
-          IMAGE_NAME: ${{ inputs.image_name }}
+          DIGEST: ${{ steps.build.outputs.digest }}
+          TAGS: ${{ steps.metadata.outputs.tags }}
         run: |
           images=()
           for tag in ${TAGS}; do
-            images+=("${REGISTRY}/${IMAGE_NAME}:${tag}@${DIGEST}")
+            images+=("${tag}@${DIGEST}")
           done
           cosign sign --yes "${images[@]}"
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
@@ -26,7 +26,7 @@ jobs:
       containerfile: ./akmods/Containerfile
       context: ./akmods
       extra_tags: |
-        39-535
+        type=raw,value=39-535
       build_args: |
         FEDORA_VERSION=39
         NVIDIA_VERSION=535
@@ -56,7 +56,7 @@ jobs:
       containerfile: ./Containerfile
       context: .
       extra_tags: |
-        ${{ matrix.fedora_version }}
+        type=raw,value=${{ matrix.fedora_version }}
       build_args: |
         FEDORA_VERSION=${{ matrix.fedora_version }}
         IMAGE_FLAVOR=${{ matrix.image_flavor }}
@@ -80,7 +80,7 @@ jobs:
       containerfile: ./config/Containerfile
       context: ./config
       extra_tags: |
-        ${{ matrix.fedora_version }}
+        type=raw,value=${{ matrix.fedora_version }}
       build_args: |
         FEDORA_VERSION=${{ matrix.fedora_version }}
 
@@ -107,7 +107,7 @@ jobs:
       containerfile: ./nvidia/Containerfile
       context: ./nvidia
       extra_tags: |
-        ${{ matrix.fedora_version }}-${{ matrix.nvidia_version }}
+        type=raw,value=${{ matrix.fedora_version }}-${{ matrix.nvidia_version }}
       build_args: |
         FEDORA_VERSION=${{ matrix.fedora_version }}
         IMAGE_FLAVOR=${{ matrix.image_flavor }}

diff --git a/akmods/Containerfile b/akmods/Containerfile
@@ -2,6 +2,7 @@ ARG BASE_IMAGE="quay.io/fedora-ostree-desktops/base"
 ARG FEDORA_VERSION="${FEDORA_VERSION:-39}"
 
 FROM ${BASE_IMAGE}:${FEDORA_VERSION} as builder
+ARG FEDORA_VERSION="${FEDORA_VERSION:-39}"
 ARG NVIDIA_VERSION="${NVIDIA_VERSION:-535}"
 
 
@@ -26,8 +27,8 @@ RUN rpm-ostree install \
 # install test or real keys
 RUN if [ ! -e /tmp/certs/private_key.priv ]; then \
 	echo "WARNING: Using test signing key" && \
-	cp /tmp/certs/private_key.priv{.test,} && \
-	cp /tmp/certs/public_key.der{.test,} \
+		cp /tmp/certs/private_key.priv{.test,} && \
+		cp /tmp/certs/public_key.der{.test,}; \
 fi
 
 RUN install -Dm644 {/tmp/certs,/etc/pki/akmods/certs}/public_key.der && \
@@ -47,7 +48,7 @@ RUN rpm-ostree install \
 RUN akmod_version="$(basename "$(rpm -q akmod-nvidia --queryformat '%{VERSION}-%{RELEASE}')" ".fc${release%%.*}")"
 RUN akmods --force --kernels "$kernel_version" --kmod nvidia
 RUN if ! modinfo /usr/lib/modules/"$kernel_version"/extra/nvidia/nvidia{,-drm,-modeset,-peermem,-uvm}.ko.xz &> /dev/null; then \
-	cat /var/cache/akmods/nvidia/"$akmod_version"-for-"$kernel_version".failed.log && exit 1 \
+	cat /var/cache/akmods/nvidia/"$akmod_version"-for-"$kernel_version".failed.log && exit 1; \
 fi
 
 
@@ -62,7 +63,7 @@ RUN rpmbuild -ba \
 # wrap everything up
 RUN cp /tmp/akmods-cert/rpmbuild/RPMS/noarch/getchoo-akmods-cert*.rpm /var/cache/rpms/akmods-cert/
 RUN find /var/cache/akmods -type f -name \*.rpm | while read -r rpm; do \
-	cp "$rpm" /var/cache/rpms/kmods/ \
+	cp "$rpm" /var/cache/rpms/kmods/; \
 done
 
 

diff --git a/base/Containerfile b/base/Containerfile
@@ -3,6 +3,7 @@ ARG BASE_IMAGE="quay.io/fedora-ostree-desktops/${IMAGE_FLAVOR}"
 ARG FEDORA_VERSION="${FEDORA_VERSION:-39}"
 
 FROM ${BASE_IMAGE}:${FEDORA_VERSION}
+ARG FEDORA_VERSION="${FEDORA_VERSION:-39}"
 
 
 COPY initial_setup.sh /usr/bin/

diff --git a/config/Containerfile b/config/Containerfile
@@ -6,6 +6,14 @@ FROM ${BASE_IMAGE}:${FEDORA_VERSION} as builder
 COPY files /tmp/files
 COPY *.spec /tmp/specs
 
+RUN dnf install \
+	--disablerepo='*' \
+	--enablerepo='fedora,updates' \
+	--setopt install_weak_deps=0 \
+	--nodocs \
+	--assumeyes \
+	rpm-build
+
 RUN mkdir -p /var/cache/rpms/container-policy /tmp/container-policy/rpmbuild/SOURCES
 RUN tar -czf /tmp/container-policy/rpmbuild/SOURCES/container-policy.tar.gz /tmp/files/
 
@@ -16,5 +24,4 @@ RUN rpmbuild -ba \
 	cp /tmp/container-policy/rpmbuild/RPMS/noarch/getchoo-container-policy*.rpm /var/cache/rpms/container-policy/
 
 FROM scratch
-RUN mkdir /rpms
 COPY --from=builder /var/cache/rpms/container-policy /rpms/container-policy