mirror of
https://github.com/open-cluster-management-io/ocm.git
synced 2026-02-14 10:00:11 +00:00
🌱 Generate sbom and attestation for images (#1110)
Some checks failed
Scorecard supply-chain security / Scorecard analysis (push) Failing after 1m47s
Post / coverage (push) Failing after 38m6s
Post / images (amd64, addon-manager) (push) Failing after 9m33s
Post / images (amd64, placement) (push) Failing after 7m47s
Post / images (amd64, registration) (push) Failing after 8m3s
Post / images (amd64, registration-operator) (push) Failing after 7m55s
Post / images (amd64, work) (push) Failing after 7m53s
Post / images (arm64, addon-manager) (push) Failing after 7m53s
Post / images (arm64, placement) (push) Failing after 7m42s
Post / images (arm64, registration) (push) Failing after 7m43s
Post / images (arm64, registration-operator) (push) Failing after 7m55s
Post / images (arm64, work) (push) Failing after 7m41s
Post / image manifest (addon-manager) (push) Has been skipped
Post / image manifest (placement) (push) Has been skipped
Post / image manifest (registration) (push) Has been skipped
Post / image manifest (registration-operator) (push) Has been skipped
Post / image manifest (work) (push) Has been skipped
Post / trigger clusteradm e2e (push) Has been skipped
Close stale issues and PRs / stale (push) Successful in 59s
Some checks failed
Scorecard supply-chain security / Scorecard analysis (push) Failing after 1m47s
Post / coverage (push) Failing after 38m6s
Post / images (amd64, addon-manager) (push) Failing after 9m33s
Post / images (amd64, placement) (push) Failing after 7m47s
Post / images (amd64, registration) (push) Failing after 8m3s
Post / images (amd64, registration-operator) (push) Failing after 7m55s
Post / images (amd64, work) (push) Failing after 7m53s
Post / images (arm64, addon-manager) (push) Failing after 7m53s
Post / images (arm64, placement) (push) Failing after 7m42s
Post / images (arm64, registration) (push) Failing after 7m43s
Post / images (arm64, registration-operator) (push) Failing after 7m55s
Post / images (arm64, work) (push) Failing after 7m41s
Post / image manifest (addon-manager) (push) Has been skipped
Post / image manifest (placement) (push) Has been skipped
Post / image manifest (registration) (push) Has been skipped
Post / image manifest (registration-operator) (push) Has been skipped
Post / image manifest (work) (push) Has been skipped
Post / trigger clusteradm e2e (push) Has been skipped
Close stale issues and PRs / stale (push) Successful in 59s
* Generate sbom and attestation for images Signed-off-by: zhujian <jiazhu@redhat.com> * Generate sbom and attestation for images Signed-off-by: zhujian <jiazhu@redhat.com> --------- Signed-off-by: zhujian <jiazhu@redhat.com>
This commit is contained in:
Jian Zhu
GitHub
113
.github/workflows/post.yml
vendored
113
.github/workflows/post.yml
vendored
@@ -18,6 +18,8 @@ env:
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
id-token: write
|
||||
attestations: write
|
||||
|
||||
jobs:
|
||||
coverage:
|
||||
@@ -47,6 +49,7 @@ jobs:
|
||||
strategy:
|
||||
matrix:
|
||||
arch: [ amd64, arm64 ]
|
||||
image-name: [ registration-operator, registration, work, placement, addon-manager ]
|
||||
steps:
|
||||
- name: checkout code
|
||||
uses: actions/checkout@v4
|
||||
@@ -57,84 +60,80 @@ jobs:
|
||||
- name: install imagebuilder
|
||||
run: go install github.com/openshift/imagebuilder/cmd/imagebuilder@v1.2.3
|
||||
- name: pull base image
|
||||
run: docker pull registry.access.redhat.com/ubi8/ubi-minimal:latest --platform=linux/${{ matrix.arch }}
|
||||
run: docker pull registry.access.redhat.com/ubi9/ubi-minimal:latest --platform=linux/${{ matrix.arch }}
|
||||
- name: images
|
||||
run: |
|
||||
IMAGE_TAG=latest-${{ matrix.arch }} \
|
||||
IMAGE_REGISTRY=quay.io/open-cluster-management \
|
||||
IMAGE_BUILD_EXTRA_FLAGS="--build-arg OS=linux --build-arg ARCH=${{ matrix.arch }}" \
|
||||
make images
|
||||
make image-${{ matrix.image-name }}
|
||||
- name: push
|
||||
run: |
|
||||
echo ${{ secrets.DOCKER_PASSWORD }} | docker login quay.io --username ${{ secrets.DOCKER_USER }} --password-stdin
|
||||
docker push quay.io/open-cluster-management/registration-operator:latest-${{ matrix.arch }}
|
||||
docker push quay.io/open-cluster-management/registration:latest-${{ matrix.arch }}
|
||||
docker push quay.io/open-cluster-management/work:latest-${{ matrix.arch }}
|
||||
docker push quay.io/open-cluster-management/placement:latest-${{ matrix.arch }}
|
||||
docker push quay.io/open-cluster-management/addon-manager:latest-${{ matrix.arch }}
|
||||
docker push quay.io/open-cluster-management/${{ matrix.image-name }}:latest-${{ matrix.arch }}
|
||||
image_digest=$(docker inspect --format='{{index .RepoDigests 0}}' "quay.io/open-cluster-management/${{ matrix.image-name }}:latest-${{ matrix.arch }}" | cut -d'@' -f2)
|
||||
echo "IMAGE_DIGEST=${image_digest}" >> $GITHUB_ENV
|
||||
- name: Generate SBOM
|
||||
uses: anchore/sbom-action@v0
|
||||
with:
|
||||
image: quay.io/open-cluster-management/${{ matrix.image-name }}:latest-${{ matrix.arch }}
|
||||
format: 'spdx-json'
|
||||
output-file: 'sbom.spdx.json'
|
||||
- name: Attest
|
||||
uses: actions/attest-sbom@v2
|
||||
id: attest
|
||||
with:
|
||||
subject-name: quay.io/open-cluster-management/${{ matrix.image-name }}
|
||||
subject-digest: ${{ env.IMAGE_DIGEST }}
|
||||
sbom-path: 'sbom.spdx.json'
|
||||
push-to-registry: true
|
||||
image-manifest:
|
||||
name: image manifest
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
matrix:
|
||||
image-name: [ registration-operator, registration, work, placement, addon-manager ]
|
||||
needs: [ images ]
|
||||
steps:
|
||||
- name: checkout code
|
||||
uses: actions/checkout@v4
|
||||
# Step to install Skopeo
|
||||
- name: Install Skopeo and jq
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y skopeo jq
|
||||
- name: create
|
||||
run: |
|
||||
echo ${{ secrets.DOCKER_PASSWORD }} | docker login quay.io --username ${{ secrets.DOCKER_USER }} --password-stdin
|
||||
# registration-operator
|
||||
docker manifest create quay.io/open-cluster-management/registration-operator:latest \
|
||||
quay.io/open-cluster-management/registration-operator:latest-amd64 \
|
||||
quay.io/open-cluster-management/registration-operator:latest-arm64
|
||||
# registration
|
||||
docker manifest create quay.io/open-cluster-management/registration:latest \
|
||||
quay.io/open-cluster-management/registration:latest-amd64 \
|
||||
quay.io/open-cluster-management/registration:latest-arm64
|
||||
# work
|
||||
docker manifest create quay.io/open-cluster-management/work:latest \
|
||||
quay.io/open-cluster-management/work:latest-amd64 \
|
||||
quay.io/open-cluster-management/work:latest-arm64
|
||||
# placement
|
||||
docker manifest create quay.io/open-cluster-management/placement:latest \
|
||||
quay.io/open-cluster-management/placement:latest-amd64 \
|
||||
quay.io/open-cluster-management/placement:latest-arm64
|
||||
# addon-manager
|
||||
docker manifest create quay.io/open-cluster-management/addon-manager:latest \
|
||||
quay.io/open-cluster-management/addon-manager:latest-amd64 \
|
||||
quay.io/open-cluster-management/addon-manager:latest-arm64
|
||||
docker manifest create quay.io/open-cluster-management/${{ matrix.image-name }}:latest \
|
||||
quay.io/open-cluster-management/${{ matrix.image-name }}:latest-amd64 \
|
||||
quay.io/open-cluster-management/${{ matrix.image-name }}:latest-arm64
|
||||
- name: annotate
|
||||
run: |
|
||||
# registration-operator
|
||||
docker manifest annotate quay.io/open-cluster-management/registration-operator:latest \
|
||||
quay.io/open-cluster-management/registration-operator:latest-amd64 --arch amd64
|
||||
docker manifest annotate quay.io/open-cluster-management/registration-operator:latest \
|
||||
quay.io/open-cluster-management/registration-operator:latest-arm64 --arch arm64
|
||||
# registration
|
||||
docker manifest annotate quay.io/open-cluster-management/registration:latest \
|
||||
quay.io/open-cluster-management/registration:latest-amd64 --arch amd64
|
||||
docker manifest annotate quay.io/open-cluster-management/registration:latest \
|
||||
quay.io/open-cluster-management/registration:latest-arm64 --arch arm64
|
||||
# work
|
||||
docker manifest annotate quay.io/open-cluster-management/work:latest \
|
||||
quay.io/open-cluster-management/work:latest-amd64 --arch amd64
|
||||
docker manifest annotate quay.io/open-cluster-management/work:latest \
|
||||
quay.io/open-cluster-management/work:latest-arm64 --arch arm64
|
||||
# placement
|
||||
docker manifest annotate quay.io/open-cluster-management/placement:latest \
|
||||
quay.io/open-cluster-management/placement:latest-amd64 --arch amd64
|
||||
docker manifest annotate quay.io/open-cluster-management/placement:latest \
|
||||
quay.io/open-cluster-management/placement:latest-arm64 --arch arm64
|
||||
# addon-manager
|
||||
docker manifest annotate quay.io/open-cluster-management/addon-manager:latest \
|
||||
quay.io/open-cluster-management/addon-manager:latest-amd64 --arch amd64
|
||||
docker manifest annotate quay.io/open-cluster-management/addon-manager:latest \
|
||||
quay.io/open-cluster-management/addon-manager:latest-arm64 --arch arm64
|
||||
docker manifest annotate quay.io/open-cluster-management/${{ matrix.image-name }}:latest \
|
||||
quay.io/open-cluster-management/${{ matrix.image-name }}:latest-amd64 --arch amd64
|
||||
docker manifest annotate quay.io/open-cluster-management/${{ matrix.image-name }}:latest \
|
||||
quay.io/open-cluster-management/${{ matrix.image-name }}:latest-arm64 --arch arm64
|
||||
- name: push
|
||||
run: |
|
||||
docker manifest push quay.io/open-cluster-management/registration-operator:latest
|
||||
docker manifest push quay.io/open-cluster-management/registration:latest
|
||||
docker manifest push quay.io/open-cluster-management/work:latest
|
||||
docker manifest push quay.io/open-cluster-management/placement:latest
|
||||
docker manifest push quay.io/open-cluster-management/addon-manager:latest
|
||||
docker manifest push quay.io/open-cluster-management/${{ matrix.image-name }}:latest
|
||||
docker pull quay.io/open-cluster-management/${{ matrix.image-name }}:latest
|
||||
image_digest_latest=$(skopeo inspect docker://quay.io/open-cluster-management/${{ matrix.image-name }}:latest | jq -r '.Digest')
|
||||
echo "IMAGE_DIGEST_LATEST=${image_digest_latest}" >> $GITHUB_ENV
|
||||
- name: Generate SBOM
|
||||
uses: anchore/sbom-action@v0
|
||||
with:
|
||||
image: quay.io/open-cluster-management/${{ matrix.image-name }}:latest
|
||||
format: 'spdx-json'
|
||||
output-file: 'sbom.spdx.json'
|
||||
- name: Attest
|
||||
uses: actions/attest-sbom@v2
|
||||
id: attest
|
||||
with:
|
||||
subject-name: quay.io/open-cluster-management/${{ matrix.image-name }}
|
||||
subject-digest: ${{ env.IMAGE_DIGEST_LATEST }}
|
||||
sbom-path: 'sbom.spdx.json'
|
||||
push-to-registry: true
|
||||
trigger-clusteradm-e2e:
|
||||
needs: [ images, image-manifest ]
|
||||
name: trigger clusteradm e2e
|
||||
|
||||
2
.github/workflows/releaseimage.yml
vendored
2
.github/workflows/releaseimage.yml
vendored
@@ -58,7 +58,7 @@ jobs:
|
||||
- name: install imagebuilder
|
||||
run: go install github.com/openshift/imagebuilder/cmd/imagebuilder@v1.2.3
|
||||
- name: pull base image
|
||||
run: docker pull registry.access.redhat.com/ubi8/ubi-minimal:latest --platform=linux/${{ matrix.arch }}
|
||||
run: docker pull registry.access.redhat.com/ubi9/ubi-minimal:latest --platform=linux/${{ matrix.arch }}
|
||||
- name: images
|
||||
run: |
|
||||
IMAGE_TAG=${{ needs.env.outputs.RELEASE_VERSION }}-${{ matrix.arch }} \
|
||||
|
||||
Reference in New Issue
Block a user