Merge pull request #46 from vyzigold/pin-gh-actions #120
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # We tag each operator with 3 tags: | |
| # 1) Git commit sha: This is useful to lookup the bundle images with SHA's | |
| # based on the gomod entries | |
| # 2) the branch name, or 'latest' tag | |
| # 3) the digest: this is useful because we reference images by SHA256 digests | |
| # in the bundles now for offline/air gapped installation support | |
| name: sg-core image builder | |
| permissions: | |
| contents: read | |
| on: | |
| push: | |
| branches: | |
| - '*' | |
| env: | |
| imageregistry: 'quay.io' | |
| imagenamespace: ${{ secrets.IMAGENAMESPACE || secrets.QUAY_USERNAME }} | |
| latesttag: latest | |
| jobs: | |
| check-secrets: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check secrets are set | |
| id: check | |
| if: "${{ env.imagenamespace == '' }}" | |
| run: | | |
| echo "::error title=Missing required secrets::See https://github.com/openstack-k8s-operators/dev-docs/blob/main/image_build.md#creating-images-using-github-actions" | |
| echo "missing=true">>$GITHUB_OUTPUT | |
| outputs: | |
| missing-secrets: ${{ steps.check.outputs.missing }} | |
| build: | |
| needs: check-secrets | |
| name: Build sg-core image using buildah | |
| runs-on: ubuntu-latest | |
| if: needs.check-secrets.outputs.missing-secrets != 'true' | |
| steps: | |
| - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3 | |
| - name: Set latest tag for non main branch | |
| if: github.ref_name != 'main' | |
| env: | |
| BRANCH_NAME: ${{ github.ref_name }} | |
| run: | | |
| echo "latesttag=${BRANCH_NAME}-latest" >> $GITHUB_ENV | |
| - name: Buildah Action | |
| id: build | |
| uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2 | |
| with: | |
| image: sg-core | |
| tags: ${{ env.latesttag }} ${{ github.sha }} | |
| containerfiles: | | |
| ./build/Dockerfile | |
| - name: Push sg-core To ${{ env.imageregistry }} | |
| uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2 | |
| with: | |
| image: ${{ steps.build.outputs.image }} | |
| tags: ${{ steps.build.outputs.tags }} | |
| registry: ${{ env.imageregistry }}/${{ env.imagenamespace }} | |
| username: ${{ secrets.QUAY_USERNAME }} | |
| password: ${{ secrets.QUAY_PASSWORD }} | |
| digestfile: digest.txt | |
| - name: Set IMAGE_DIGEST for sg-core and tag | |
| shell: bash | |
| run: | | |
| DIGEST=$(cat digest.txt | sed -e 's|sha256:||') | |
| echo "IMAGE_DIGEST=$DIGEST" >> $GITHUB_ENV | |
| podman tag "localhost/${IMAGE}:${GITHUB_SHA}" "${REGISTRY}/${IMAGE}:${DIGEST}" | |
| env: | |
| REGISTRY: ${{ env.imageregistry }}/${{ env.imagenamespace }} | |
| IMAGE: sg-core | |
| GITHUB_SHA: ${{ github.sha }} | |
| - name: Push tag with digest ${{ env.OPERATOR_IMAGE_DIGEST }} | |
| uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2 | |
| with: | |
| image: sg-core | |
| tags: ${{ env.IMAGE_DIGEST }} | |
| registry: ${{ env.imageregistry }}/${{ env.imagenamespace }} | |
| username: ${{ secrets.QUAY_USERNAME }} | |
| password: ${{ secrets.QUAY_PASSWORD }} |