Skip to content

chore(deps): update go to v1.22.7 (main) (patch) #9559

chore(deps): update go to v1.22.7 (main) (patch)

chore(deps): update go to v1.22.7 (main) (patch) #9559

Workflow file for this run

name: Image CI Build
on:
pull_request_target:
types:
- opened
- synchronize
- reopened
paths-ignore:
- 'docs/**'
push:
branches:
- main
- test*
paths-ignore:
- 'docs/**'
permissions:
# To be able to access the repository with `actions/checkout`
contents: read
# Required to generate OIDC tokens for `sigstore/cosign-installer` authentication
id-token: write
jobs:
build-and-push-prs:
runs-on: ubuntu-22.04
strategy:
matrix:
include:
- name: tetragon
dockerfile: ./Dockerfile
- name: tetragon-operator
dockerfile: ./Dockerfile.operator
- name: tetragon-rthooks
dockerfile: ./Dockerfile.rthooks
steps:
# https://github.com/docker/setup-qemu-action
- name: Set up QEMU
uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
with:
platforms: arm64
# https://github.com/docker/setup-buildx-action
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0
- name: Login to quay.io for CI
uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
with:
registry: quay.io
username: ${{ secrets.QUAY_USERNAME_CI }}
password: ${{ secrets.QUAY_PASSWORD_CI }}
- name: Getting image tag
id: tag
run: |
if [ ${{ github.event.pull_request.head.sha }} != "" ]; then
echo "tag=${{ github.event.pull_request.head.sha }}" >> $GITHUB_OUTPUT
else
echo "tag=${{ github.sha }}" >> $GITHUB_OUTPUT
fi
if [ ${{ github.event_name }} == "push" ]; then
if [ ${{ github.ref_name }} == "main" ]; then
echo "name=latest" | tee -a $GITHUB_OUTPUT
else
echo "name=${{ github.ref_name }}" | tee -a $GITHUB_OUTPUT
fi
fi
- name: Checkout main branch
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
with:
persist-credentials: false
ref: ${{ github.event.repository.default_branch }}
fetch-depth: 0
- name: Get version
run: |
echo "TETRAGON_VERSION=$(make version)" >> $GITHUB_ENV
# Warning: since this is a privileged workflow, subsequent workflow job
# steps must take care not to execute untrusted code.
- name: Checkout pull request branch (NOT TRUSTED)
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
with:
persist-credentials: false
ref: ${{ steps.tag.outputs.tag }}
fetch-depth: 0
- name: Install Cosign
uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2
- name: Install Go
uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
with:
# renovate: datasource=golang-version depName=go
go-version: '1.22.7'
- name: Install Bom
shell: bash
env:
# renovate: datasource=github-releases depName=kubernetes-sigs/bom
BOM_VERSION: v0.6.0
run: |
go install sigs.k8s.io/bom/cmd/bom@${{ env.BOM_VERSION }}
# main branch pushes
- name: CI Build (main)
if: ${{ github.event_name == 'push' }}
uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
id: docker_build_ci_main
with:
provenance: false
context: .
file: ${{ matrix.dockerfile }}
push: true
platforms: linux/amd64,linux/arm64
build-args: |
TETRAGON_VERSION=${{ env.TETRAGON_VERSION }}
tags: |
quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci:${{ steps.tag.outputs.tag }}
quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci:${{ steps.tag.outputs.name }}
- name: Sign Container Image
if: github.event_name == 'push'
env:
COSIGN_EXPERIMENTAL: "true"
run: |
cosign sign -y quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci@${{ steps.docker_build_ci_main.outputs.digest }}
- name: Generate SBOM
if: github.event_name == 'push'
shell: bash
# To-Do: Format SBOM output to JSON after a new version of cosign is released after v1.13.1. Ref: https://github.com/sigstore/cosign/pull/2479
run: |
bom generate -o sbom_ci_main_${{ matrix.name }}_${{ steps.tag.outputs.tag }}.spdx \
--dirs=. \
--image=quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci:${{ steps.tag.outputs.tag }}
- name: Attach SBOM to container images
if: github.event_name == 'push'
run: |
cosign attach sbom --sbom sbom_ci_main_${{ matrix.name }}_${{ steps.tag.outputs.tag }}.spdx quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci@${{ steps.docker_build_ci_main.outputs.digest }}
- name: Sign SBOM Image
if: github.event_name == 'push'
env:
COSIGN_EXPERIMENTAL: "true"
run: |
docker_build_ci_main_digest="${{ steps.docker_build_ci_main.outputs.digest }}"
image_name="quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci:${docker_build_ci_main_digest/:/-}.sbom"
docker_build_ci_main_sbom_digest="sha256:$(docker buildx imagetools inspect --raw ${image_name} | sha256sum | head -c 64)"
cosign sign -y "quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci@${docker_build_ci_main_sbom_digest}"
- name: CI Image Releases digests (main)
if: github.event_name == 'push'
shell: bash
run: |
mkdir -p image-digest/
echo "quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci:${{ steps.tag.outputs.tag }}@${{ steps.docker_build_ci_main.outputs.digest }}" >> image-digest/${{ matrix.name }}.txt
# PR updates
- name: CI Build (PR)
if: github.event_name == 'pull_request_target' || github.event_name == 'pull_request'
uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
id: docker_build_ci_pr
with:
provenance: false
context: .
file: ${{ matrix.dockerfile }}
push: true
platforms: linux/amd64,linux/arm64
build-args: |
TETRAGON_VERSION=${{ env.TETRAGON_VERSION }}
tags: |
quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci:${{ steps.tag.outputs.tag }}
- name: Sign Container Image
if: github.event_name == 'pull_request_target' || github.event_name == 'pull_request'
env:
COSIGN_EXPERIMENTAL: "true"
run: |
cosign sign -y quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci@${{ steps.docker_build_ci_pr.outputs.digest }}
- name: Generate SBOM
if: github.event_name == 'pull_request_target' || github.event_name == 'pull_request'
shell: bash
# To-Do: Format SBOM output to JSON after a new version of cosign is released after v1.13.1. Ref: https://github.com/sigstore/cosign/pull/2479
run: |
bom generate --format json -o sbom_ci_pr_${{ matrix.name }}_${{ steps.tag.outputs.tag }}.spdx \
--dirs=. \
--image=quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci:${{ steps.tag.outputs.tag }}
- name: Attach SBOM to container images
if: github.event_name == 'pull_request_target' || github.event_name == 'pull_request'
run: |
cosign attach sbom --sbom sbom_ci_pr_${{ matrix.name }}_${{ steps.tag.outputs.tag }}.spdx quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci@${{ steps.docker_build_ci_pr.outputs.digest }}
- name: Sign SBOM Image
if: github.event_name == 'pull_request_target' || github.event_name == 'pull_request'
env:
COSIGN_EXPERIMENTAL: "true"
run: |
docker_build_ci_pr_digest="${{ steps.docker_build_ci_pr.outputs.digest }}"
image_name="quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci:${docker_build_ci_pr_digest/:/-}.sbom"
docker_build_ci_pr_sbom_digest="sha256:$(docker buildx imagetools inspect --raw ${image_name} | sha256sum | head -c 64)"
cosign sign -y "quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci@${docker_build_ci_pr_sbom_digest}"
- name: CI Image Releases digests (PR)
if: github.event_name == 'pull_request_target' || github.event_name == 'pull_request'
shell: bash
run: |
mkdir -p image-digest/
echo "quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci:${{ steps.tag.outputs.tag }}@${{ steps.docker_build_ci_pr.outputs.digest }}" >> image-digest/${{ matrix.name }}.txt
# Upload artifact digests
- name: Upload artifact digests
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with:
name: image-digest ${{ matrix.name }}
path: image-digest
retention-days: 1
image-digests:
if: ${{ always() }}
name: Display Digests
runs-on: ubuntu-22.04
needs: [build-and-push-prs]
steps:
- name: Downloading Image Digests
shell: bash
run: |
mkdir -p image-digest/
- name: Download digests of all images built
uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
with:
path: image-digest/
- name: Image Digests Output
shell: bash
run: |
cd image-digest/
find -type f | sort | xargs -d '\n' cat