Skip to content

Commit 8dfd427

Browse files
oliverbaehleroliverbaehler
authored
feat: initial release actions (#1)
* feat: initial actions
1 parent 64bead7 commit 8dfd427

File tree

4 files changed

+214
-0
lines changed

4 files changed

+214
-0
lines changed

‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
# github-actions
2+
23
Github Reusable Actions

‎exists/action.yaml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: Checks if an input is defined
2+
3+
description: Checks if an input is defined and outputs 'true' or 'false'.
4+
5+
inputs:
6+
value:
7+
description: value to test
8+
required: true
9+
10+
outputs:
11+
result:
12+
description: outputs 'true' or 'false' if input value is defined or not
13+
value: ${{ steps.check.outputs.result }}
14+
15+
runs:
16+
using: composite
17+
steps:
18+
- shell: bash
19+
id: check
20+
run: |
21+
echo "result=${{ inputs.value != '' }}" >> $GITHUB_OUTPUT

‎helm-oci-chart/action.yaml

+104
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
name: Helm OCI Chart Releaser
2+
description: Push Helm charts to OCI-based (Docker) registries
3+
inputs:
4+
name:
5+
required: true
6+
description: Chart name
7+
repository:
8+
required: true
9+
description: Chart repository name
10+
app-version:
11+
description: "Chart Application Version"
12+
required: false
13+
version:
14+
required: false
15+
description: Chart version
16+
path:
17+
required: false
18+
description: Chart path (Default 'charts/{name}')
19+
registry:
20+
required: true
21+
description: OCI registry
22+
registry-username:
23+
required: true
24+
description: OCI registry username
25+
registry-password:
26+
required: true
27+
description: OCI registry password
28+
update-dependencies:
29+
required: false
30+
default: 'false'
31+
description: Update chart dependencies before packaging (Default 'false')
32+
sign-image:
33+
required: false
34+
default: 'false'
35+
description: Sign chart package with Cosign
36+
signature-repository:
37+
required: true
38+
description: signature repository
39+
40+
outputs:
41+
digest:
42+
value: ${{ steps.helm-push.outputs.digest }}
43+
description: "Chart digest"
44+
image:
45+
value: ${{ steps.helm-push.outputs.image }}
46+
description: Chart image (Default '{registry}/{repository}/{image}:{version}')
47+
runs:
48+
using: composite
49+
steps:
50+
51+
- name: Helm | Login
52+
shell: bash
53+
run: echo ${{ inputs.registry-password }} | helm registry login -u ${{ inputs.registry-username }} --password-stdin ${{ inputs.registry }}
54+
env:
55+
HELM_EXPERIMENTAL_OCI: '1'
56+
57+
- name: Cosign | Login
58+
if: inputs.sign-image == 'true'
59+
shell: bash
60+
run: cosign login --username ${{ inputs.registry-username }} --password ${{ inputs.registry-password }} ${{ inputs.registry }}
61+
62+
- name: Helm | Dependency
63+
if: inputs.update-dependencies == 'true'
64+
shell: bash
65+
run: helm dependency update ${{ inputs.path == null && format('{0}/{1}', 'charts', inputs.name) || inputs.path }}
66+
env:
67+
HELM_EXPERIMENTAL_OCI: '1'
68+
69+
- name: Helm | Package
70+
shell: bash
71+
run: helm package --destination ./chart-build/ ${{ inputs.path == null && format('{0}/{1}', 'charts', inputs.name) || inputs.path }} ${{ inputs.version != '' && format('--version={0}', inputs.version) || '' }} ${{ inputs.app-version != '' && format('--app-version={0}', inputs.app-version) || '' }}
72+
env:
73+
HELM_EXPERIMENTAL_OCI: '1'
74+
75+
- name: Helm | Push
76+
shell: bash
77+
id: helm-push
78+
run: |
79+
CHART_FILE=$(find ./chart-build -name "*.tgz" -print -quit)
80+
helm push $CHART_FILE oci://${{ inputs.registry }}/${{ inputs.repository }} |& tee digest
81+
DIGEST=$(sed -n '/Digest:/s/Digest: //p' digest)
82+
echo "image=${{ inputs.registry }}/${{ inputs.repository }}/${{ inputs.name }}:${{ inputs.version }}" >> $GITHUB_OUTPUT
83+
echo "digest=$DIGEST" >> $GITHUB_OUTPUT
84+
env:
85+
HELM_EXPERIMENTAL_OCI: '1'
86+
87+
- name: Cosign | Sign
88+
shell: bash
89+
if: inputs.sign-image == 'true'
90+
env:
91+
COSIGN_REPOSITORY: ${{ inputs.signature-repository }}
92+
run: |
93+
set -e
94+
cosign sign --yes \
95+
-a "repo=${{ github.repository }}" \
96+
-a "workflow=${{ github.workflow }}" \
97+
-a "ref=${{ github.sha }}" \
98+
${{ steps.helm-push.outputs.image }}@${{ steps.helm-push.outputs.digest }}
99+
100+
- name: Helm | Logout
101+
shell: bash
102+
run: helm registry logout ${{ inputs.registry }}
103+
env:
104+
HELM_EXPERIMENTAL_OCI: '1'

‎ko-publish-image/action.yaml

+88
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
name: Publish image
2+
3+
description: Publishes a docker image, SBOM, scans vulns, and signs the image.
4+
5+
inputs:
6+
makefile-target:
7+
required: true
8+
description: makefile target to invoke for publishing image with ko
9+
registry:
10+
required: true
11+
description: registry to publish image to
12+
registry-username:
13+
required: true
14+
description: registry credentials username
15+
registry-password:
16+
required: true
17+
description: registry credentials password
18+
repository:
19+
required: true
20+
description: repository to publish image to
21+
version:
22+
required: true
23+
description: published image version
24+
sign-image:
25+
required: true
26+
description: sign image
27+
sbom-name:
28+
required: true
29+
description: name of the cyclonedx sbom
30+
sbom-repository:
31+
required: true
32+
description: sbom repository
33+
signature-repository:
34+
required: true
35+
description: signature repository
36+
main-path:
37+
required: true
38+
description: path to main go entry point
39+
40+
outputs:
41+
digest:
42+
value: ${{ steps.digest.outputs.digest }}
43+
description: published image digest
44+
45+
runs:
46+
using: composite
47+
steps:
48+
- shell: bash
49+
id: ko-publish
50+
env:
51+
REGISTRY: ${{ inputs.registry }}
52+
REPO: ${{ inputs.repository }}
53+
REGISTRY_PASSWORD: ${{ inputs.registry-password }}
54+
COSIGN_REPOSITORY: ${{ inputs.sbom-repository }}
55+
run: |
56+
set -e
57+
echo "digest=$(VERSION=${{ inputs.version }} make ${{ inputs.makefile-target }})" >> $GITHUB_OUTPUT
58+
- uses: CycloneDX/gh-gomod-generate-sbom@d4aee0cf5133055dbd98899978246c10c18c440f # v1.1.0
59+
with:
60+
version: v1
61+
args: app -licenses -json -output ${{ inputs.sbom-name }}-bom.cdx.json -main ${{ inputs.main-path }}
62+
- uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
63+
with:
64+
name: ${{ inputs.sbom-name }}-bom-cdx
65+
path: ${{ inputs.sbom-name }}-bom.cdx.json
66+
- shell: bash
67+
if: ${{ inputs.sign-image == 'true' }}
68+
env:
69+
COSIGN_REPOSITORY: ${{ inputs.signature-repository }}
70+
run: |
71+
set -e
72+
cosign sign --yes \
73+
-a "repo=${{ github.repository }}" \
74+
-a "workflow=${{ github.workflow }}" \
75+
-a "ref=${{ github.sha }}" \
76+
${{ steps.ko-publish.outputs.digest }}
77+
- shell: bash
78+
env:
79+
COSIGN_REPOSITORY: ${{ inputs.sbom-repository }}
80+
run: |
81+
cosign attach sbom --sbom ./${{ inputs.sbom-name }}-bom.cdx.json --type cyclonedx ${{ steps.ko-publish.outputs.digest }}
82+
- shell: bash
83+
id: digest
84+
run: |
85+
echo "The image generated is: ${{ steps.ko-publish.outputs.digest }}"
86+
DIGEST=$(echo ${{ steps.ko-publish.outputs.digest }} | cut -d '@' -f2)
87+
echo "Digest from image is: $DIGEST"
88+
echo "digest=$DIGEST" >> $GITHUB_OUTPUT

0 commit comments

Comments
 (0)