Skip to content

Commit c0c510c

Browse files
janfuhrerjanfuhrer
authored
Merge pull request #19 from natrontech/feat/jfu
feat: restructure CI, add git files
2 parents 009bf5c + 5c64051 commit c0c510c

21 files changed

+785
-107
lines changed

‎.editorconfig

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
root = true
2+
3+
[*]
4+
charset = utf-8
5+
end_of_line = lf
6+
insert_final_newline = true
7+
trim_trailing_whitespace = true
8+
9+
[{*.go,Makefile,.gitmodules,go.mod,go.sum}]
10+
indent_style = tab
11+
12+
[*.md]
13+
indent_style = tab
14+
trim_trailing_whitespace = false
15+
16+
[*.{yml,yaml,json}]
17+
indent_style = space
18+
indent_size = 2

‎.github/ISSUE_TEMPLATE/bug_report.md

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
name: Bug report
3+
about: Create a report to help me improve
4+
title: ''
5+
labels: ''
6+
assignees: ''
7+
8+
---
9+
10+
**Describe the bug**
11+
A clear and concise description of what the bug is.
12+
13+
**To Reproduce**
14+
Steps to reproduce the behavior.
15+
16+
**Expected behavior**
17+
A clear and concise description of what you expected to happen.
18+
19+
**Screenshots**
20+
If applicable, add screenshots to help explain your problem.
21+
22+
**Additional context**
23+
Add any other context about the problem here.

‎.github/ISSUE_TEMPLATE/feature_request.md

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
name: Feature request
3+
about: Suggest an idea for this project
4+
title: ''
5+
labels: ''
6+
assignees: ''
7+
8+
---
9+
10+
**Is your feature request related to a problem? Please describe.**
11+
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
12+
13+
**Describe the solution you'd like**
14+
A clear and concise description of what you want to happen.
15+
16+
**Describe any alternatives you've considered**
17+
A clear and concise description of any alternative solutions or features you've considered.
18+
19+
**Additional context**
20+
Add any additional context or screenshots about the feature request here.

‎.github/dependabot.yml

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,15 @@
1-
# To get started with Dependabot version updates, you'll need to specify which
2-
# package ecosystems to update and where the package manifests are located.
3-
# Please see the documentation for all configuration options:
4-
# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
5-
61
version: 2
72
updates:
8-
# GitHub Actions
93
- package-ecosystem: "github-actions"
104
directory: "/"
115
schedule:
126
interval: "weekly"
137
commit-message:
14-
prefix: ":seedling:"
8+
prefix: ":seedling:"
9+
10+
- package-ecosystem: "docker"
11+
directory: /
12+
schedule:
13+
interval: "weekly"
14+
commit-message:
15+
prefix: ":robot:"

‎.github/workflows/README.md

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# GitHub Workflows
2+
3+
## Overview
4+
5+
Following workflows are implemented in the repository.
6+
[SARIF](https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning) is used to store the results for an analysis of code scanning tools in the Security tab of the repository.
7+
8+
| Workflow | Jobs | Trigger | SARIF upload | Description |
9+
| :------------------------------- | :------------------------------ | :------------------------------------------------------------ | :----------- | ------------------------------------------------------------------------ |
10+
| [cleanup.yml](./cleanup.yml) | `clean` | workflow_dispatch, cron `0 0 * * *` | - | Cleanup all untagged tags from GHCR repository which are older than `2w` |
11+
| [release.yml](./release.yml) | see [release chapter](#release) | push tag `v*`, cron `20 14 * * *`, pr on `main` | - | Create release with go binaries and docker container |
12+
| [scorecard.yml](./scorecard.yml) | `analyze` | push to `main`, cron: `00 14 * * 1`, change branch protection | yes | Create OpenSSF analysis and create project score |
13+
14+
## Release
15+
16+
The release workflow includes multiple jobs to create a release of the project. Following jobs are implemented:
17+
18+
| Job | GitHub Action | Description |
19+
| :------------------------- | :------------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------------- |
20+
| `docker-publish` | - | Build and sign the container image, create and sign the SBOM with Syft |
21+
| `image-provenance` | [generator_container_slsa3](https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/container) | Generates provenance for the container images |
22+
| `verification-with-cosign` | - | Verifying the cryptographic signatures on provenance for the container image |
23+
24+
### Container Release
25+
26+
The docker image provenance is generated using the [SLSA Container Generator](https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/container) and uploaded to the GitHub registry. The provenance can be verified using the `slsa-verifier` or `cosign` tool (see [Release Verification](./../../SECURITY.md#release-verification)).
27+
28+
### Container SBOM
29+
30+
The SBOMs of the container images are uploaded to a separate package registry (see [SBOM](./../../SECURITY.md#sbom) for more information).
31+
32+
## Scorecards
33+
34+
Action: https://github.com/ossf/scorecard-action
35+
36+
[Scorecards](https://github.com/ossf/scorecard) is a tool that provides a security score for open-source projects. The workflow runs the scorecard on the repository and uploads the results to the Security tab of the repository. There is also a report on the OpenSSF website, the link is available in the README file by clicking on the OpenSSF Scorecard badge.
37+
38+
[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/natrontech/gcp-mysql-backup/badge)](https://securityscorecards.dev/viewer/?uri=github.com/natrontech/gcp-mysql-backup)

‎.github/workflows/cleanup.yml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: GHCR cleanup
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "0 0 * * *" # every day at midnight, utc
7+
8+
permissions: {}
9+
10+
jobs:
11+
clean:
12+
runs-on: ubuntu-latest
13+
name: Delete old test images
14+
steps:
15+
- name: cleanup ghcr
16+
uses: snok/[email protected]
17+
with:
18+
account: natrontech
19+
token: ${{ secrets.GITHUB_TOKEN }}
20+
image-names: "gcp-mysql-backup"
21+
cut-off: 2w
22+
tag-selection: untagged
23+
dry-run: false

‎.github/workflows/docker-publish.yml

Lines changed: 0 additions & 83 deletions
This file was deleted.

‎.github/workflows/release.yml

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
name: release
2+
3+
on:
4+
schedule:
5+
- cron: '20 14 * * *'
6+
push:
7+
tags:
8+
- "v*"
9+
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: false
13+
14+
permissions: {}
15+
16+
jobs:
17+
docker-publish:
18+
outputs:
19+
digest: ${{ steps.build-and-push.outputs.digest }}
20+
runs-on: ubuntu-latest
21+
permissions:
22+
contents: write
23+
packages: write
24+
id-token: write # sign archives with cosign
25+
steps:
26+
- name: Checkout repository
27+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
28+
with:
29+
persist-credentials: false
30+
fetch-depth: 0
31+
- name: Set up Docker Buildx
32+
uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
33+
- name: Install Cosign
34+
uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
35+
- name: Login to GitHub Container Registry
36+
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
37+
with:
38+
registry: ghcr.io
39+
username: ${{ github.actor }}
40+
password: ${{ secrets.GITHUB_TOKEN }}
41+
- name: Extract Docker metadata
42+
id: meta
43+
uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
44+
with:
45+
images: ghcr.io/${{ github.repository }}
46+
- name: Build and push Docker image
47+
id: build-and-push
48+
uses: docker/build-push-action@0adf9959216b96bec444f325f1e493d4aa344497 # v6.14.0
49+
with:
50+
context: .
51+
tags: ${{ steps.meta.outputs.tags }}
52+
push: true
53+
labels: ${{ steps.meta.outputs.labels }}
54+
cache-from: type=gha
55+
cache-to: type=gha,mode=max
56+
- name: Syft SBOM generation
57+
uses: anchore/sbom-action@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0.18.0
58+
with:
59+
image: ghcr.io/natrontech/gcp-mysql-backup@${{ steps.build-and-push.outputs.digest }}
60+
format: cyclonedx-json
61+
output-file: gcp-mysql-backup-bom.cdx.json
62+
upload-artifact: false
63+
upload-release-assets: false
64+
- name: Cosign sign image
65+
# env:
66+
# COSIGN_REPOSITORY: ghcr.io/${{ github.repository_owner }}/signatures
67+
run: |
68+
set -e
69+
cosign sign --yes \
70+
-a "repo=${{ github.repository }}" \
71+
-a "workflow=${{ github.workflow }}" \
72+
-a "ref=${{ github.sha }}" \
73+
ghcr.io/natrontech/gcp-mysql-backup@${{ steps.build-and-push.outputs.digest }}
74+
- name: Cosign sign sbom
75+
# env:
76+
# COSIGN_REPOSITORY: ghcr.io/${{ github.repository_owner }}/sbom
77+
run: |
78+
cosign attest --yes \
79+
--predicate ./gcp-mysql-backup-bom.cdx.json \
80+
--type cyclonedx \
81+
--oidc-provider github-actions \
82+
ghcr.io/natrontech/gcp-mysql-backup@${{ steps.build-and-push.outputs.digest }}
83+
84+
image-provenance:
85+
needs: [docker-publish]
86+
permissions:
87+
actions: read
88+
id-token: write
89+
packages: write
90+
# MUST be referenced by tag (see https://github.com/slsa-framework/slsa-github-generator/?tab=readme-ov-file#referencing-slsa-builders-and-generators)
91+
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
92+
with:
93+
image: ghcr.io/${{ github.repository_owner }}/gcp-mysql-backup
94+
digest: ${{ needs.docker-publish.outputs.digest }}
95+
registry-username: ${{ github.actor }}
96+
provenance-registry-username: ${{ github.actor }}
97+
#provenance-repository: ghcr.io/${{ github.repository_owner }}/signatures
98+
secrets:
99+
registry-password: ${{ secrets.GITHUB_TOKEN }}
100+
provenance-registry-password: ${{ secrets.GITHUB_TOKEN }}
101+
102+
verification-with-cosign:
103+
needs: [docker-publish, image-provenance]
104+
runs-on: ubuntu-latest
105+
permissions: read-all
106+
steps:
107+
- name: Checkout repository
108+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
109+
with:
110+
persist-credentials: false
111+
fetch-depth: 0
112+
113+
- name: Login
114+
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
115+
with:
116+
registry: ghcr.io
117+
username: ${{ github.actor }}
118+
password: ${{ secrets.GITHUB_TOKEN }}
119+
120+
- name: Install Cosign
121+
uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
122+
123+
- name: Verify provenance of image
124+
env:
125+
IMAGE: ghcr.io/${{ github.repository_owner }}/gcp-mysql-backup
126+
DIGEST: ${{ needs.docker-publish.outputs.digest }}
127+
REPOSITORY: ${{ github.repository_owner }}
128+
run: |
129+
cosign verify-attestation \
130+
--type slsaprovenance \
131+
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
132+
--certificate-identity-regexp '^https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v[0-9]+.[0-9]+.[0-9]+$' \
133+
--policy policy.cue \
134+
$IMAGE@$DIGEST
135+
136+
- name: Verify signature of image
137+
env:
138+
IMAGE: ghcr.io/${{ github.repository_owner }}/gcp-mysql-backup
139+
DIGEST: ${{ needs.docker-publish.outputs.digest }}
140+
REPOSITORY: ${{ github.repository_owner }}
141+
run: |
142+
cosign verify \
143+
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
144+
--certificate-identity-regexp '^https://github.com/natrontech/gcp-mysql-backup/.github/workflows/release.yml@refs/tags/v[0-9]+.[0-9]+.[0-9]+(-rc.[0-9]+)?$' \
145+
--certificate-identity-regexp '^https://github.com/natrontech/gcp-mysql-backup/.github/workflows/release.yml@refs/heads/main$' \
146+
$IMAGE@$DIGEST
147+
148+
- name: Verify sbom of image
149+
env:
150+
IMAGE: ghcr.io/${{ github.repository_owner }}/gcp-mysql-backup
151+
DIGEST: ${{ needs.docker-publish.outputs.digest }}
152+
REPOSITORY: ${{ github.repository_owner }}
153+
run: |
154+
cosign verify-attestation \
155+
--type cyclonedx \
156+
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
157+
--certificate-identity-regexp '^https://github.com/natrontech/gcp-mysql-backup/.github/workflows/release.yml@refs/tags/v[0-9]+.[0-9]+.[0-9]+(-rc.[0-9]+)?$' \
158+
--certificate-identity-regexp '^https://github.com/natrontech/gcp-mysql-backup/.github/workflows/release.yml@refs/heads/main$' \
159+
$IMAGE@$DIGEST

0 commit comments

Comments
 (0)