mirror of
https://github.com/rustfs/rustfs.git
synced 2026-11-10 20:28:47 +00:00
Chris An
2780bba67b
* ci: stage release builds and promote verified artifacts * fix: preserve release package and channel retry contracts * fix: align installation chart versions with sealed candidates
100 lines
3.8 KiB
YAML
100 lines
3.8 KiB
YAML
# Copyright 2026 RustFS Team
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
name: Build candidate images
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
candidate_manifest:
|
|
type: string
|
|
required: true
|
|
permissions:
|
|
contents: read
|
|
actions: read
|
|
jobs:
|
|
build-docker:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 90
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- variant: musl
|
|
file: Dockerfile
|
|
- variant: gnu
|
|
file: Dockerfile.glibc
|
|
env:
|
|
CANDIDATE_MANIFEST: ${{ inputs.candidate_manifest }}
|
|
VARIANT: ${{ matrix.variant }}
|
|
steps:
|
|
- uses: actions/checkout@f548e57e544e1ff5a4c46bf1e1b8685f8e4a348a # v7
|
|
with:
|
|
ref: ${{ fromJson(inputs.candidate_manifest).source_sha }}
|
|
persist-credentials: false
|
|
- name: Reuse completed image
|
|
id: reuse
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: python3 scripts/release/deliver.py reuse --kind image --target "$VARIANT"
|
|
- name: Install OCI tools
|
|
if: steps.reuse.outputs.reused != 'true'
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y skopeo
|
|
- uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
|
|
if: steps.reuse.outputs.reused != 'true'
|
|
- uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
|
|
if: steps.reuse.outputs.reused != 'true'
|
|
- name: Supply accepted binaries and pinned CLI
|
|
if: steps.reuse.outputs.reused != 'true'
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: python3 scripts/release/deliver.py image-prepare --target "$VARIANT"
|
|
- name: Build OCI archive without registry writes
|
|
if: steps.reuse.outputs.reused != 'true'
|
|
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
|
|
with:
|
|
context: .
|
|
file: ${{ matrix.file }}
|
|
platforms: linux/amd64,linux/arm64
|
|
push: false
|
|
provenance: false
|
|
outputs: type=oci,dest=delivery/image-${{ matrix.variant }}.tar
|
|
build-args: |
|
|
BINARY_SOURCE=supplied
|
|
RELEASE=${{ fromJson(inputs.candidate_manifest).version }}
|
|
VCS_REF=${{ fromJson(inputs.candidate_manifest).source_sha }}
|
|
- name: Verify wrapped binaries and startup on both architectures
|
|
if: steps.reuse.outputs.reused != 'true'
|
|
run: python3 scripts/release/deliver.py image-smoke --target "$VARIANT"
|
|
- name: Scan amd64 image before sealing
|
|
if: steps.reuse.outputs.reused != 'true'
|
|
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
|
|
env:
|
|
TRIVY_PLATFORM: linux/amd64
|
|
with:
|
|
input: delivery-scan/image-${{ matrix.variant }}-amd64.tar
|
|
format: sarif
|
|
output: delivery/scan-${{ matrix.variant }}-amd64.sarif
|
|
exit-code: "0" # Keep the repository's report-only vulnerability policy.
|
|
- name: Scan arm64 image before sealing
|
|
if: steps.reuse.outputs.reused != 'true'
|
|
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
|
|
env:
|
|
TRIVY_PLATFORM: linux/arm64
|
|
with:
|
|
input: delivery-scan/image-${{ matrix.variant }}-arm64.tar
|
|
format: sarif
|
|
output: delivery/scan-${{ matrix.variant }}-arm64.sarif
|
|
exit-code: "0"
|
|
- name: Record verified OCI identity
|
|
if: steps.reuse.outputs.reused != 'true'
|
|
run: python3 scripts/release/deliver.py image-record --target "$VARIANT"
|
|
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
if: steps.reuse.outputs.reused != 'true'
|
|
with:
|
|
name: image-${{ matrix.variant }}
|
|
path: delivery/*
|
|
if-no-files-found: error
|
|
retention-days: 30
|
|
compression-level: 0
|