terraform-github-actions/.github/workflows/base-image.yaml at c7399a415d441a2efb6beb84dfac73ff976c8b88 · dflook/terraform-github-actions · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
name: Update base image

on:
  push:
    branches:
      - trixie
    paths:
      - image/Dockerfile-base
      - .github/workflows/base-image.yaml
  schedule:
    - cron: 0 1 1 * *

permissions:
  contents: read

jobs:
  push_image:
    runs-on: ubuntu-24.04
    name: Docker Images
    permissions:
      id-token: write
      attestations: write
    environment:
      name: dockerhub
      url: https://hub.docker.com/r/danielflook/terraform-github-actions-base/tags?name=${{ github.run_id }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Registry login
        env:
          DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
        run: |
          echo "$DOCKER_TOKEN" | docker login --username danielflook --password-stdin

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Base image
        id: build-and-push
        run: |
          BASE_DIGEST=$(docker buildx imagetools inspect "debian:trixie-slim" --format '{{json .}}' | jq -r '.manifest.digest')

          sed -i "s|FROM debian:trixie-slim|FROM debian:trixie-slim@$BASE_DIGEST|" "image/Dockerfile-base"

          docker buildx build \
            --tag "danielflook/terraform-github-actions-base:$GITHUB_RUN_ID" \
            --tag danielflook/terraform-github-actions-base:trixie  \
            --platform linux/amd64,linux/arm64 \
            --attest "type=provenance,mode=max,builder-id=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
            --annotation "index,manifest:org.opencontainers.image.created=$(date '+%Y-%m-%dT%H:%M:%S%z')" \
            --annotation "index,manifest:org.opencontainers.image.source=https://github.com/${{ github.repository }}" \
            --annotation "index,manifest:org.opencontainers.image.revision=${{ github.sha }}" \
            --annotation "index,manifest:org.opencontainers.image.title=terraform-github-actions-base" \
            --annotation "index,manifest:org.opencontainers.image.description=Base image for terraform-github-actions" \
            --annotation "index:org.opencontainers.image.ref.name=docker.io/danielflook/terraform-github-actions-base:$GITHUB_RUN_ID" \
            --annotation "index,manifest:builder-id=$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
            --annotation "index,manifest:ref.tag=$GITHUB_RUN_ID" \
            --annotation "index,manifest:org.opencontainers.image.base.name=docker.io/debian:trixie-slim" \
            --annotation "index,manifest:base.manifest.digest=$BASE_DIGEST" \
            --file image/Dockerfile-base \
            --push \
            --iidfile manifest-list-digest.txt \
            image

          echo "digest=$(<manifest-list-digest.txt)" >> "$GITHUB_OUTPUT"

      - name: Generate image attestation
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-name: index.docker.io/danielflook/terraform-github-actions-base
          subject-digest: ${{ steps.build-and-push.outputs.digest }}