forked from repo-mirrors/cnpg-postgres-containers
76 lines
2.4 KiB
YAML
76 lines
2.4 KiB
YAML
name: Copy and sign images
|
|
description: Copy and sign images to the production repository
|
|
inputs:
|
|
bake_build_metadata:
|
|
description: "The JSON build metadata of Bake"
|
|
required: true
|
|
registry_user:
|
|
description: "The user used to authenticate to the registry"
|
|
required: true
|
|
registry_token:
|
|
description: "The token used to authenticate to the registry"
|
|
required: true
|
|
test_registry_suffix:
|
|
description: "The testing registry suffix"
|
|
required: false
|
|
default: '-testing'
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Log in to the GitHub Container registry
|
|
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ inputs.registry_user }}
|
|
password: ${{ inputs.registry_token }}
|
|
|
|
- name: Copy images
|
|
shell: bash
|
|
env:
|
|
# renovate: datasource=docker depName=quay.io/skopeo/stable versioning=loose
|
|
SKOPEO_VERSION: "v1.20.0-immutable"
|
|
SUFFIX: ${{ inputs.test_registry_suffix }}
|
|
run: |
|
|
images=$(echo '${{ inputs.bake_build_metadata }}' |
|
|
jq -r '
|
|
.[] as $items |
|
|
(
|
|
$items."image.name" |
|
|
split(",")[] +
|
|
"@" +
|
|
$items."containerimage.digest"
|
|
)
|
|
'
|
|
)
|
|
for image in $images
|
|
do
|
|
testimageshaonly="${image%:*@*}@${image#*@}"
|
|
testimagenosha="${image%@*}"
|
|
prodimage="${testimagenosha/$SUFFIX/}"
|
|
echo "Copying ${testimageshaonly} to ${prodimage}"
|
|
docker run --quiet quay.io/skopeo/stable:$SKOPEO_VERSION copy -q -a \
|
|
--dest-creds ${{ inputs.registry_user }}:${{ inputs.registry_token }} \
|
|
docker://${testimageshaonly} docker://${prodimage}
|
|
done
|
|
|
|
- name: Install cosign
|
|
uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
|
|
|
|
- name: Sign images
|
|
shell: bash
|
|
env:
|
|
SUFFIX: ${{ inputs.test_registry_suffix }}
|
|
run: |
|
|
images=$(echo '${{ inputs.bake_build_metadata }}' |
|
|
jq -r --arg suffix "$SUFFIX" '.[] |
|
|
(
|
|
."image.name" |
|
|
sub(",.*";"") |
|
|
sub($suffix + ":[^@]+";"")
|
|
) + "@" + ."containerimage.digest"
|
|
'
|
|
)
|
|
echo "Signing ${images}"
|
|
cosign sign -t 5m --yes ${images}
|