wehub-resource-sync
409 lines
15 KiB
YAML
409 lines
15 KiB
YAML
name: Publish to Docker Hub
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
tags:
|
|
- "v*"
|
|
paths-ignore:
|
|
- ".github/workflows/**"
|
|
# Use 'released' instead of 'published' so editing/re-publishing old releases
|
|
# does NOT re-trigger this workflow. 'released' fires only on the initial
|
|
# release publication (and pre-release → release transition).
|
|
release:
|
|
types: [released]
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: "Version tag to build (e.g. 3.8.4)"
|
|
required: true
|
|
type: string
|
|
promote_latest:
|
|
description: "Also tag :latest (only if this is the highest semver)"
|
|
required: false
|
|
type: boolean
|
|
default: false
|
|
|
|
# Least-privilege default: read-only at the top level; the build and merge jobs that
|
|
# push to GHCR grant packages: write themselves (Scorecard TokenPermissions).
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
prepare:
|
|
name: Resolve Docker release metadata
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
version: ${{ steps.version.outputs.version }}
|
|
promote_latest: ${{ steps.version.outputs.promote_latest }}
|
|
skip: ${{ steps.version.outputs.skip }}
|
|
env:
|
|
IMAGE_NAME: diegosouzapw/omniroute
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v7
|
|
with:
|
|
persist-credentials: false
|
|
ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/v{0}', inputs.version) || '' }}
|
|
# Need full tag history for semver comparison when deciding :latest.
|
|
fetch-depth: 0
|
|
|
|
- name: Resolve version, latest-promotion, and skip flag
|
|
id: version
|
|
env:
|
|
EVENT_NAME: ${{ github.event_name }}
|
|
REF_NAME: ${{ github.ref_name }}
|
|
REF_TYPE: ${{ github.ref_type }}
|
|
INPUT_VERSION: ${{ inputs.version }}
|
|
PROMOTE_INPUT: ${{ inputs.promote_latest }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
# 1) Resolve version string from the trigger (all inputs come via env).
|
|
case "$EVENT_NAME" in
|
|
workflow_dispatch)
|
|
VERSION="${INPUT_VERSION#v}"
|
|
;;
|
|
push)
|
|
if [ "$REF_TYPE" = "tag" ]; then
|
|
VERSION="${REF_NAME#v}"
|
|
else
|
|
# Push to main → build & tag as `main` only. Never touch :latest.
|
|
VERSION="main"
|
|
fi
|
|
;;
|
|
release)
|
|
VERSION="${REF_NAME#v}"
|
|
;;
|
|
*)
|
|
VERSION="${REF_NAME#v}"
|
|
;;
|
|
esac
|
|
# Sanity-check: only allow [A-Za-z0-9._-] in VERSION (defense in depth).
|
|
if ! printf '%s' "$VERSION" | grep -qE '^[A-Za-z0-9._-]+$'; then
|
|
echo "Refusing to use unsafe VERSION value: $VERSION" >&2
|
|
exit 1
|
|
fi
|
|
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
|
|
|
|
# 2) Decide whether to promote :latest.
|
|
PROMOTE="false"
|
|
if [ "$VERSION" = "main" ]; then
|
|
PROMOTE="false"
|
|
elif printf '%s' "$VERSION" | grep -qE -- '-(rc|alpha|beta|pre|next)'; then
|
|
echo "Pre-release identifier detected — skipping :latest."
|
|
PROMOTE="false"
|
|
elif [ "$EVENT_NAME" = "workflow_dispatch" ]; then
|
|
PROMOTE="${PROMOTE_INPUT:-false}"
|
|
else
|
|
git fetch --tags --quiet || true
|
|
# Decide via the extracted helper, which folds VERSION into the
|
|
# candidate set so the result is independent of git-tag sync timing
|
|
# on `release` events (#5301). Without that, the freshly-created tag
|
|
# is often not yet visible here and :latest stays a release behind.
|
|
PROMOTE=$(git tag -l 'v[0-9]*' | bash scripts/ci/should-promote-latest.sh "$VERSION")
|
|
if [ "$PROMOTE" != "true" ]; then
|
|
echo "Version $VERSION is not the highest stable semver. Not promoting :latest."
|
|
fi
|
|
fi
|
|
echo "promote_latest=$PROMOTE" >> "$GITHUB_OUTPUT"
|
|
|
|
# 3) Skip if this exact version is already published in Docker Hub.
|
|
# `main` is always rebuilt (mutable floating tag).
|
|
SKIP="false"
|
|
if [ "$VERSION" != "main" ]; then
|
|
if docker manifest inspect "diegosouzapw/omniroute:${VERSION}" >/dev/null 2>&1; then
|
|
echo "Image diegosouzapw/omniroute:${VERSION} already exists on Docker Hub — skipping rebuild."
|
|
SKIP="true"
|
|
fi
|
|
fi
|
|
echo "skip=$SKIP" >> "$GITHUB_OUTPUT"
|
|
|
|
echo "Publishing diegosouzapw/omniroute:$VERSION (promote_latest=$PROMOTE, skip=$SKIP)"
|
|
|
|
build:
|
|
name: Build Docker (${{ matrix.platform }})
|
|
needs: prepare
|
|
if: needs.prepare.outputs.skip != 'true'
|
|
runs-on: ${{ matrix.runner }}
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- platform: linux/amd64
|
|
runner: ubuntu-24.04
|
|
arch: amd64
|
|
- platform: linux/arm64
|
|
runner: ubuntu-24.04-arm
|
|
arch: arm64
|
|
env:
|
|
IMAGE_NAME: diegosouzapw/omniroute
|
|
GHCR_IMAGE_NAME: ghcr.io/diegosouzapw/omniroute
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v7
|
|
with:
|
|
persist-credentials: false
|
|
ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/v{0}', inputs.version) || '' }}
|
|
fetch-depth: 0
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v4
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@v4
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- name: Login to GitHub Container Registry
|
|
uses: docker/login-action@v4
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Build and push platform image by digest
|
|
id: build
|
|
uses: docker/build-push-action@v7
|
|
with:
|
|
context: .
|
|
target: runner-base
|
|
platforms: ${{ matrix.platform }}
|
|
outputs: type=image,push-by-digest=true,name-canonical=true,push=true
|
|
tags: |
|
|
${{ env.IMAGE_NAME }}
|
|
${{ env.GHCR_IMAGE_NAME }}
|
|
cache-from: type=gha,scope=docker-${{ matrix.arch }}
|
|
cache-to: type=gha,scope=docker-${{ matrix.arch }},mode=max
|
|
no-cache: false
|
|
env:
|
|
DOCKER_BUILDKIT_INLINE_CACHE: 1
|
|
|
|
- name: Build and push WEB platform image by digest
|
|
id: build-web
|
|
uses: docker/build-push-action@v7
|
|
with:
|
|
context: .
|
|
target: runner-web
|
|
platforms: ${{ matrix.platform }}
|
|
outputs: type=image,push-by-digest=true,name-canonical=true,push=true
|
|
tags: |
|
|
${{ env.IMAGE_NAME }}
|
|
${{ env.GHCR_IMAGE_NAME }}
|
|
cache-from: type=gha,scope=docker-web-${{ matrix.arch }}
|
|
cache-to: type=gha,scope=docker-web-${{ matrix.arch }},mode=max
|
|
no-cache: false
|
|
env:
|
|
DOCKER_BUILDKIT_INLINE_CACHE: 1
|
|
|
|
- name: Export digests
|
|
env:
|
|
DIGEST_BASE: ${{ steps.build.outputs.digest }}
|
|
DIGEST_WEB: ${{ steps.build-web.outputs.digest }}
|
|
run: |
|
|
set -euo pipefail
|
|
mkdir -p /tmp/digests/base /tmp/digests/web
|
|
touch "/tmp/digests/base/${DIGEST_BASE#sha256:}"
|
|
touch "/tmp/digests/web/${DIGEST_WEB#sha256:}"
|
|
|
|
- name: Upload base digests
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: digests-base-${{ matrix.arch }}
|
|
path: /tmp/digests/base/*
|
|
if-no-files-found: error
|
|
retention-days: 1
|
|
|
|
- name: Upload web digests
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: digests-web-${{ matrix.arch }}
|
|
path: /tmp/digests/web/*
|
|
if-no-files-found: error
|
|
retention-days: 1
|
|
|
|
merge:
|
|
name: Publish multi-arch manifests
|
|
needs:
|
|
- prepare
|
|
- build
|
|
if: needs.prepare.outputs.skip != 'true'
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
security-events: write
|
|
env:
|
|
IMAGE_NAME: diegosouzapw/omniroute
|
|
GHCR_IMAGE_NAME: ghcr.io/diegosouzapw/omniroute
|
|
VERSION: ${{ needs.prepare.outputs.version }}
|
|
PROMOTE_LATEST: ${{ needs.prepare.outputs.promote_latest }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v7
|
|
with:
|
|
persist-credentials: false
|
|
ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/v{0}', inputs.version) || '' }}
|
|
fetch-depth: 0
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v4
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@v4
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- name: Login to GitHub Container Registry
|
|
uses: docker/login-action@v4
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Download base digests
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
pattern: digests-base-*
|
|
path: /tmp/digests/base
|
|
merge-multiple: true
|
|
|
|
- name: Download web digests
|
|
uses: actions/download-artifact@v8
|
|
with:
|
|
pattern: digests-web-*
|
|
path: /tmp/digests/web
|
|
merge-multiple: true
|
|
|
|
- name: Create Docker Hub manifest
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
create_manifest() {
|
|
local image="$1" suffix="$2" dir="$3"
|
|
local tags=(-t "${image}:${VERSION}${suffix}")
|
|
if [ "$PROMOTE_LATEST" = "true" ]; then
|
|
tags+=(-t "${image}:latest${suffix}")
|
|
fi
|
|
local refs=()
|
|
while IFS= read -r digest_file; do
|
|
refs+=("${image}@sha256:$(basename "$digest_file")")
|
|
done < <(find "$dir" -type f | sort)
|
|
if [ "${#refs[@]}" -eq 0 ]; then
|
|
echo "No image digests in $dir" >&2
|
|
exit 1
|
|
fi
|
|
docker buildx imagetools create "${tags[@]}" "${refs[@]}"
|
|
}
|
|
|
|
create_manifest "${IMAGE_NAME}" "" /tmp/digests/base
|
|
create_manifest "${IMAGE_NAME}" "-web" /tmp/digests/web
|
|
|
|
- name: Create GHCR manifest
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
create_manifest() {
|
|
local image="$1" suffix="$2" dir="$3"
|
|
local tags=(-t "${image}:${VERSION}${suffix}")
|
|
if [ "$PROMOTE_LATEST" = "true" ]; then
|
|
tags+=(-t "${image}:latest${suffix}")
|
|
fi
|
|
local refs=()
|
|
while IFS= read -r digest_file; do
|
|
refs+=("${image}@sha256:$(basename "$digest_file")")
|
|
done < <(find "$dir" -type f | sort)
|
|
if [ "${#refs[@]}" -eq 0 ]; then
|
|
echo "No image digests in $dir" >&2
|
|
exit 1
|
|
fi
|
|
docker buildx imagetools create "${tags[@]}" "${refs[@]}"
|
|
}
|
|
|
|
create_manifest "${GHCR_IMAGE_NAME}" "" /tmp/digests/base
|
|
create_manifest "${GHCR_IMAGE_NAME}" "-web" /tmp/digests/web
|
|
|
|
- name: Inspect image
|
|
if: needs.prepare.outputs.version != 'main'
|
|
run: |
|
|
docker buildx imagetools inspect "${IMAGE_NAME}:${VERSION}"
|
|
|
|
- name: Generate CycloneDX SBOM (image, advisory)
|
|
if: needs.prepare.outputs.version != 'main'
|
|
continue-on-error: true
|
|
uses: anchore/sbom-action@v0
|
|
with:
|
|
image: ${{ env.GHCR_IMAGE_NAME }}:${{ env.VERSION }}
|
|
format: cyclonedx-json
|
|
output-file: sbom-image.cdx.json
|
|
artifact-name: sbom-image.cdx.json
|
|
|
|
# Visibility scan: reports HIGH + CRITICAL into the SARIF (Security tab) but
|
|
# never blocks (exit-code 0). The blocking gate below narrows to CRITICAL.
|
|
#
|
|
# ignore-unfixed mirrors the blocking gate: the Security tab must surface only
|
|
# ACTIONABLE vulnerabilities — ones with a published fix we can pull by rebuilding
|
|
# on a patched base or bumping the dep. Without it the advisory upload floods the
|
|
# tab with unfixable base-image OS CVEs (Debian trixie packages with no upstream
|
|
# patch yet, overwhelmingly local-only and not reachable from the proxy request
|
|
# surface), which is noise an operator cannot act on. trivyignores points at the
|
|
# repo-root .trivyignore so accepted-risk fixable CVEs have one auditable home.
|
|
# See docs/security/SUPPLY_CHAIN.md.
|
|
- name: Trivy image scan (SARIF, advisory)
|
|
if: needs.prepare.outputs.version != 'main'
|
|
continue-on-error: true
|
|
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
|
|
with:
|
|
image-ref: ${{ env.GHCR_IMAGE_NAME }}:${{ env.VERSION }}
|
|
format: sarif
|
|
output: trivy-results.sarif
|
|
severity: HIGH,CRITICAL
|
|
ignore-unfixed: true
|
|
trivyignores: .trivyignore
|
|
exit-code: "0"
|
|
|
|
# BLOCKING gate (v3.8.27 cycle-end): fail the release on a CRITICAL CVE in the
|
|
# published image. Narrowed to severity CRITICAL (HIGH stays visible in the
|
|
# SARIF step above, not blocking). ignore-unfixed:true so an unfixable base-image
|
|
# CVE with no upstream patch does not red the release (reduces false-blocks);
|
|
# a fixable CRITICAL still blocks. Per docs/security/SUPPLY_CHAIN.md. NB: Trivy
|
|
# scans against a CVE DB that grows continuously — a newly-disclosed CRITICAL on
|
|
# an unchanged base image can red this gate; the fix is to rebuild on a patched
|
|
# base, bump the dep, or add a justified .trivyignore entry (see the CVE-variance
|
|
# note in docs/security/SUPPLY_CHAIN.md).
|
|
- name: Trivy CRITICAL gate (blocking)
|
|
if: needs.prepare.outputs.version != 'main'
|
|
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
|
|
with:
|
|
image-ref: ${{ env.GHCR_IMAGE_NAME }}:${{ env.VERSION }}
|
|
format: table
|
|
severity: CRITICAL
|
|
ignore-unfixed: true
|
|
exit-code: "1"
|
|
|
|
- name: Upload Trivy SARIF to Security tab
|
|
if: needs.prepare.outputs.version != 'main'
|
|
continue-on-error: true
|
|
uses: github/codeql-action/upload-sarif@v4
|
|
with:
|
|
sarif_file: trivy-results.sarif
|
|
category: trivy-image
|
|
|
|
- name: Update Docker Hub description
|
|
# Only refresh README/description when we actually promote :latest
|
|
# (avoids overwriting from main pushes or back-fill builds).
|
|
if: needs.prepare.outputs.promote_latest == 'true'
|
|
uses: peter-evans/dockerhub-description@v5
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
repository: diegosouzapw/omniroute
|
|
short-description: "OmniRoute — Unified AI proxy. Route any LLM through one endpoint."
|
|
readme-filepath: ./README.md
|