|
| 1 | +name: Promote Tested Image to Release Tag |
| 2 | + |
| 3 | +# Promoting does not rebuild anything. The image CI already built, tested and scanned |
| 4 | +# for this commit is promoted to the release tag by copying its manifest, so the |
| 5 | +# promoted artifact is byte for byte the one that passed the pipeline. A rebuild would |
| 6 | +# not be equivalent: the Dockerfile runs `apt-get upgrade`, so the same source produces |
| 7 | +# a different image whenever Ubuntu has moved on. |
| 8 | +# |
| 9 | +# The caller is expected to trigger this workflow from a push of a `vX.Y.Z` tag, or of |
| 10 | +# a component tag such as `component-vX.Y.Z` when release-please is configured to include |
| 11 | +# the component name, and to pass the registry credentials. The tag is validated against |
| 12 | +# the version release-please recorded for that component in .release-please-manifest.json. |
| 13 | + |
| 14 | +on: |
| 15 | + workflow_call: |
| 16 | + inputs: |
| 17 | + ci-workflow: |
| 18 | + description: "Workflow file of the CI that built and pushed the tested image (used to look up its run for the commit)" |
| 19 | + type: string |
| 20 | + default: "ci.yaml" |
| 21 | + image-name: |
| 22 | + description: "OCI image name (registry/repository) to promote, e.g. docker-regis.iex.ec/iexec-result-proxy" |
| 23 | + type: string |
| 24 | + required: true |
| 25 | + registry: |
| 26 | + description: "Registry the image lives in" |
| 27 | + type: string |
| 28 | + default: "docker.io" |
| 29 | + security-scan: |
| 30 | + description: "Enable Trivy Security Scan" |
| 31 | + type: boolean |
| 32 | + default: true |
| 33 | + trivy-version: |
| 34 | + description: "Trivy security scanner version" |
| 35 | + type: string |
| 36 | + default: "v0.71.0" |
| 37 | + secrets: |
| 38 | + username: |
| 39 | + description: "Registry username" |
| 40 | + required: true |
| 41 | + password: |
| 42 | + description: "Registry password (read and write access to the registry)" |
| 43 | + required: true |
| 44 | + |
| 45 | +permissions: |
| 46 | + contents: read |
| 47 | + # required to look up the CI run that built the tagged commit |
| 48 | + actions: read |
| 49 | + |
| 50 | +jobs: |
| 51 | + promote: |
| 52 | + name: Promote the tested image to the release tag |
| 53 | + runs-on: ubuntu-latest |
| 54 | + |
| 55 | + # avoid shell injection through string interpolation |
| 56 | + env: |
| 57 | + CI_WORKFLOW: ${{ inputs.ci-workflow }} |
| 58 | + IMAGE: ${{ inputs.image-name }} |
| 59 | + REGISTRY: ${{ inputs.registry }} |
| 60 | + |
| 61 | + steps: |
| 62 | + - name: Checkout |
| 63 | + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
| 64 | + with: |
| 65 | + fetch-depth: 0 |
| 66 | + |
| 67 | + - name: Check the tag and the project version agree |
| 68 | + id: check |
| 69 | + env: |
| 70 | + TAG: ${{ github.ref_name }} |
| 71 | + run: | |
| 72 | + if [ -z "$(git branch -r --contains "$GITHUB_SHA" 'origin/main')" ]; then |
| 73 | + echo "❌ Tag $TAG is not on main. Release tags must be created on main." |
| 74 | + exit 1 |
| 75 | + fi |
| 76 | +
|
| 77 | + # release-please records the released version of every component in |
| 78 | + # .release-please-manifest.json, committed in the same PR as the version bump, |
| 79 | + # so at the tagged commit it holds exactly the version being released. |
| 80 | + version="${TAG##*-v}" |
| 81 | + if [ "$version" = "$TAG" ]; then |
| 82 | + version="${TAG#v}" |
| 83 | + component="." |
| 84 | + else |
| 85 | + component="${TAG%-v$version}" |
| 86 | + fi |
| 87 | +
|
| 88 | + if [ ! -f ".release-please-manifest.json" ]; then |
| 89 | + echo "❌ No .release-please-manifest.json at the repository root." |
| 90 | + echo " The project has to be released by release-please in manifest mode." |
| 91 | + exit 1 |
| 92 | + fi |
| 93 | +
|
| 94 | + declared=$(COMPONENT="$component" python3 - <<'PY' |
| 95 | + import json |
| 96 | + import os |
| 97 | + from pathlib import Path |
| 98 | +
|
| 99 | + component = os.environ["COMPONENT"] |
| 100 | + manifest = json.loads(Path(".release-please-manifest.json").read_text()) |
| 101 | + if component != ".": |
| 102 | + print(next((v for path, v in manifest.items() if path == component or path.rsplit("/", 1)[-1] == component), "")) |
| 103 | + else: |
| 104 | + keys = list(manifest) |
| 105 | + print(manifest["."] if "." in manifest else manifest[keys[0]] if len(keys) == 1 else "") |
| 106 | + PY |
| 107 | + ) |
| 108 | +
|
| 109 | + if [ -z "$declared" ]; then |
| 110 | + echo "❌ No version recorded for component '$component' in .release-please-manifest.json" |
| 111 | + exit 1 |
| 112 | + fi |
| 113 | +
|
| 114 | + if [ "$version" != "$declared" ]; then |
| 115 | + echo "❌ Tag version ($version) does not match the version release-please recorded for '$component' ($declared)" |
| 116 | + exit 1 |
| 117 | + fi |
| 118 | +
|
| 119 | + echo "✅ Tag $TAG matches $component version $declared" |
| 120 | +
|
| 121 | + echo "version=$version" | tee -a "$GITHUB_OUTPUT" |
| 122 | +
|
| 123 | + - name: Wait for the CI run that built this commit |
| 124 | + id: wait |
| 125 | + env: |
| 126 | + GH_TOKEN: ${{ github.token }} |
| 127 | + run: | |
| 128 | + # Both workflows start from the same push to main: release-please creates this |
| 129 | + # tag within a minute, while CI needs several more to build and push the image |
| 130 | + # being promoted. So the image is normally still missing when this job starts. |
| 131 | + for _ in $(seq 1 60); do |
| 132 | + run=$(gh run list --commit "$GITHUB_SHA" --workflow "$CI_WORKFLOW" --limit 1 \ |
| 133 | + --json status,conclusion,databaseId \ |
| 134 | + --jq '.[] | "\(.status) \(.conclusion) \(.databaseId)"' 2>/dev/null || true) |
| 135 | + status=${run%% *} |
| 136 | + rest=${run#* } |
| 137 | + conclusion=${rest%% *} |
| 138 | + run_id=${rest##* } |
| 139 | +
|
| 140 | + case "$status" in |
| 141 | + completed) |
| 142 | + if [ "$conclusion" = "success" ]; then |
| 143 | + echo "✅ CI succeeded for $GITHUB_SHA" |
| 144 | + echo "run_id=$run_id" >> "$GITHUB_OUTPUT" |
| 145 | + exit 0 |
| 146 | + fi |
| 147 | + echo "❌ CI for $GITHUB_SHA concluded '$conclusion'; refusing to release" |
| 148 | + exit 1 |
| 149 | + ;; |
| 150 | + "") |
| 151 | + echo "No CI run found yet for $GITHUB_SHA, waiting…" |
| 152 | + ;; |
| 153 | + *) |
| 154 | + echo "CI is $status, waiting…" |
| 155 | + ;; |
| 156 | + esac |
| 157 | + sleep 30 |
| 158 | + done |
| 159 | +
|
| 160 | + echo "❌ Timed out after 30 minutes waiting for the CI run on $GITHUB_SHA" |
| 161 | + exit 1 |
| 162 | +
|
| 163 | + - name: Download the image tag CI built for this commit |
| 164 | + id: ci-tag |
| 165 | + continue-on-error: true |
| 166 | + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 |
| 167 | + with: |
| 168 | + name: docker-image-tag |
| 169 | + path: ci-image-tag |
| 170 | + run-id: ${{ steps.wait.outputs.run_id }} |
| 171 | + github-token: ${{ github.token }} |
| 172 | + |
| 173 | + - name: Resolve the source tag to promote |
| 174 | + id: source-tag |
| 175 | + run: | |
| 176 | + if [ ! -f "ci-image-tag/image-tag.txt" ]; then |
| 177 | + echo "❌ CI run did not publish the docker-image-tag artifact; cannot determine the image to promote" |
| 178 | + echo " The CI workflow ($CI_WORKFLOW) must upload a 'docker-image-tag' artifact containing the tag it pushed" |
| 179 | + exit 1 |
| 180 | + fi |
| 181 | + source_tag=$(cat "ci-image-tag/image-tag.txt") |
| 182 | + echo "✅ CI recorded image tag $source_tag" |
| 183 | + echo "source_tag=$source_tag" | tee -a "$GITHUB_OUTPUT" |
| 184 | +
|
| 185 | + - name: Login to Docker Registry |
| 186 | + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 |
| 187 | + with: |
| 188 | + registry: ${{ inputs.registry }} |
| 189 | + username: ${{ secrets.username }} |
| 190 | + password: ${{ secrets.password }} |
| 191 | + |
| 192 | + - name: Set up Docker Buildx |
| 193 | + # imagetools needs no builder, but this guarantees a buildx recent enough to support --prefer-index |
| 194 | + uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 |
| 195 | + |
| 196 | + - name: Resolve the digest CI built for this commit |
| 197 | + id: tested |
| 198 | + env: |
| 199 | + SOURCE_TAG: ${{ steps.source-tag.outputs.source_tag }} |
| 200 | + run: | |
| 201 | + digest=$(docker buildx imagetools inspect "$IMAGE:$SOURCE_TAG" \ |
| 202 | + --format '{{.Manifest.Digest}}') |
| 203 | + echo " $SOURCE_TAG -> $digest" |
| 204 | + echo "digest=$digest" >> "$GITHUB_OUTPUT" |
| 205 | +
|
| 206 | + # Scanning before the promotion, not after: the release tag would land on this |
| 207 | + # very digest, so a vulnerability found here must stop the release rather than be |
| 208 | + # reported against an image already tagged as released. The digest is unchanged by |
| 209 | + # the promotion, so this is a scan of exactly what gets released. |
| 210 | + - name: Re-scan the tested image for newly disclosed vulnerabilities |
| 211 | + if: ${{ inputs.security-scan }} |
| 212 | + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 |
| 213 | + with: |
| 214 | + image-ref: ${{ env.IMAGE }}@${{ steps.tested.outputs.digest }} |
| 215 | + format: table |
| 216 | + ignore-unfixed: true |
| 217 | + vuln-type: 'os,library' |
| 218 | + severity: 'CRITICAL,HIGH' |
| 219 | + hide-progress: true |
| 220 | + exit-code: 1 |
| 221 | + # same scanner version as the CI build, so a finding here means the |
| 222 | + # vulnerability database moved, not the tool |
| 223 | + version: ${{ inputs.trivy-version }} |
| 224 | + |
| 225 | + - name: Promote the tested image to the release tag |
| 226 | + env: |
| 227 | + SOURCE_TAG: ${{ steps.source-tag.outputs.source_tag }} |
| 228 | + VERSION: ${{ steps.check.outputs.version }} |
| 229 | + DIGEST: ${{ steps.tested.outputs.digest }} |
| 230 | + run: | |
| 231 | + # --prefer-index=false copies the manifest verbatim. Without it buildx wraps a |
| 232 | + # single-source manifest in an OCI index, which gives the release tag a new |
| 233 | + # digest and defeats the point of promoting the exact image that was tested. |
| 234 | + docker buildx imagetools create --prefer-index=false \ |
| 235 | + -t "$IMAGE:$VERSION" "$IMAGE:$SOURCE_TAG" |
| 236 | +
|
| 237 | + released=$(docker buildx imagetools inspect "$IMAGE:$VERSION" \ |
| 238 | + --format '{{.Manifest.Digest}}') |
| 239 | + echo " $SOURCE_TAG -> $DIGEST" |
| 240 | + echo " $VERSION -> $released" |
| 241 | +
|
| 242 | + if [ "$released" != "$DIGEST" ]; then |
| 243 | + echo "❌ $IMAGE:$VERSION does not point at the tested image." |
| 244 | + echo " A buildx too old to honour --prefer-index wraps the manifest in an index." |
| 245 | + exit 1 |
| 246 | + fi |
| 247 | +
|
| 248 | + echo "✅ $IMAGE:$VERSION is the image CI built and tested for $GITHUB_SHA" |
| 249 | +
|
| 250 | + - name: Summarise the release |
| 251 | + env: |
| 252 | + SOURCE_TAG: ${{ steps.source-tag.outputs.source_tag }} |
| 253 | + VERSION: ${{ steps.check.outputs.version }} |
| 254 | + DIGEST: ${{ steps.tested.outputs.digest }} |
| 255 | + run: | |
| 256 | + { |
| 257 | + echo "### 🚀 Released \`$IMAGE:$VERSION\`" |
| 258 | + echo "" |
| 259 | + echo "Promoted from \`$SOURCE_TAG\` without rebuilding." |
| 260 | + echo "" |
| 261 | + echo "<table><tbody>" |
| 262 | + echo "<tr><td><b>Commit</b></td><td><code>$GITHUB_SHA</code></td></tr>" |
| 263 | + echo "<tr><td><b>Source tag</b></td><td><code>$SOURCE_TAG</code></td></tr>" |
| 264 | + echo "<tr><td><b>Digest</b></td><td><code>$DIGEST</code></td></tr>" |
| 265 | + echo "</tbody></table>" |
| 266 | + } >> "$GITHUB_STEP_SUMMARY" |
0 commit comments