Publish official Docker container

.github/workflows/build.yml

@@ -25,6 +25,13 @@ on:
         type: boolean
 name: Build and Test
 env:
+  HOME_REPO: aj-stein-gsa/oscal-cli
+  IMAGE_NAME: aj-stein-gsa/oscal-cli-extended
+  REGISTRY: ghcr.io
+  # Docs: github.com/docker/metadata-action/?tab=readme-ov-file#typesha
+  DOCKER_METADATA_PR_HEAD_SHA: true
+  # https://github.com/docker/metadata-action?tab=readme-ov-file#annotations
+  DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index  
   INPUT_FAIL_ON_ERROR: ${{ github.event.inputs.linkcheck_fail_on_error || 'true' }}
   INPUT_ISSUE_ON_ERROR: ${{ github.event.inputs.linkcheck_create_issue || 'false' }}
   MAVEN_VERSION: 3.9.8
@@ -73,6 +80,71 @@ jobs:
       uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd
       with:
         upload: ${{ github.ref_name == 'develop' && 'always' || 'never' }}
+    - if: github.repository == env.HOME_REPO
+      name: Container image QEMU setup for cross-arch builds
+      id: image_setup_qemu
+      uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf
+    - if: github.repository == env.HOME_REPO
+      name: Container image buildx setup for cross-arch builds
+      id: image_setup_buildx
+      with:
+        platforms: linux/amd64
+      uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db
+    - if: github.repository == env.HOME_REPO
+      name: Container image login
+      id: image_login
+      uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+      with:
+        registry: ${{ env.REGISTRY }}
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    - if: github.repository == env.HOME_REPO
+      name: Container image metadata and tag generation
+      id: image_metadata
+      uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81
+      with:
+        images:
+          ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+        tags: |
+          type=sha,prefix=,suffix=,format=long
+          type=ref,event=branch
+          type=ref,event=tag
+          type=ref,event=pr
+        # flavor: |
+        #   latest=true
+        annotations: |
+          maintainers="Metaschema Community Admin <[email protected]>"
+          org.opencontainers.image.authors="Metaschema Community Admin <[email protected]>"
+          org.opencontainers.image.documentation="https://metaschema.dev"
+          org.opencontainers.image.source="https://github.com/metaschema-framework/oscal-cli"
+          org.opencontainers.image.vendor="Metaschema Community"
+          org.opencontainers.image.title="oscal-cli-extended"
+          org.opencontainers.image.description="Metaschema-powered CLI tool for processing OSCAL""
+          org.opencontainers.image.licenses="CC0-1.0"
+    - run: |
+          pwd
+          ls -lha
+          find '.'
+    - if: github.repository == env.HOME_REPO && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/feature'))
+      name: Container image registry push
+      id: image_registry_push
+      uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+      with:
+        build-args: |
+          USE_PREBUILT_ZIP=yes        
+        push: true
+        tags: ${{ steps.image_metadata.outputs.tags }}
+        labels: ${{ steps.image_metadata.outputs.annotations }}
+        platforms: linux/amd64
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+    - if: github.repository == env.HOME_REPO && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/feature'))
+      name: Container image push attestations
+      uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c
+      with:
+        subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
+        subject-digest: ${{ steps.image_registry_push.outputs.digest }}
+        push-to-registry: false        
   build-website:
     name: Website
     runs-on: ubuntu-20.04
@@ -146,3 +218,5 @@ jobs:
       with:
         script: |
           core.setFailed('Link checker detected broken or invalid links, read attached report.')
+
+

Dockerfile

@@ -0,0 +1,54 @@
+ARG BUILDER_IMAGE=maven:3.9.9-eclipse-temurin-17-alpine
+ARG RUNNER_IMAGE=eclipse-temurin:17-alpine
+# Not set by default, so it will build in container locally. See the GitHub
+# Actions build.yml where build-arg is provider to override and build inside
+# the container.
+ARG USE_PREBUILT_ZIP
+
+FROM ${BUILDER_IMAGE} AS builder
+ARG USE_PREBUILT_ZIP
+ARG BUILDER_JDK_VENDOR=temurin
+ARG BUILDER_JDK_MAJOR_VERSION=17
+ARG BUILDER_JDK_HOME_PATH=/opt/java/openjdk
+ADD . /usr/local/src
+# You can't copy conditionally for a folder that doesn't exist.
+# Make the build boostrap files regardless.
+RUN mkdir -p "/root/.m2"
+COPY  <<M2TEMPLATE /root/.m2/toolchains.xml
+<?xml version="1.0" encoding="UTF-8"?>
+<toolchains>
+    <toolchain>
+    <type>jdk</type>
+    <provides>
+        <version>${BUILDER_JDK_MAJOR_VERSION}</version>
+        <vendor>${BUILDER_JDK_VENDOR}</vendor>
+        <id>${BUILDER_JDK_VENDOR}_${BUILDER_JDK_MAJOR_VERSION}</id>
+    </provides>
+    <configuration>
+        <jdkHome>${BUILDER_JDK_HOME_PATH}</jdkHome>
+    </configuration>
+    </toolchain>
+</toolchains>
+M2TEMPLATE
+RUN if [[ -z "$USE_PREBUILT_ZIP" ]]; then \
+        apk add --no-cache git unzip && \
+        cd /usr/local/src && \
+        mvn -B -e -Prelease package && \
+        cp ./target/*.zip /tmp; \
+    else \
+        echo "Using prebuilt ZIP archive from outside container"; \
+    fi
+
+# Conditional source to prevent failed check for pre-built zip when the variable
+# USE_PREBUILT_ZIP is set. See the following:
+# https://stackoverflow.com/a/43656644   
+# https://stackoverflow.com/a/46801962
+COPY pom.xml ./target/*.zi[p] /tmp
+WORKDIR /tmp
+RUN unzip *.zip -d /opt/oscal-cli-extended
+
+FROM ${RUNNER_IMAGE} AS runner
+COPY --from=builder /opt/oscal-cli-extended /opt/oscal-cli-extended
+WORKDIR /opt/oscal-cli-extended
+RUN /opt/oscal-cli-extended/bin/oscal-cli --version
+ENTRYPOINT [ "/opt/oscal-cli-extended/bin/oscal-cli" ]