build(deps): bump google.golang.org/api from 0.271.0 to 0.272.0 (#2130) #4320
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build Images | |
| on: | |
| pull_request: | |
| branches: [ "main" ] | |
| push: | |
| branches: [ "main" ] | |
| workflow_dispatch: | |
| permissions: {} | |
| jobs: | |
| # Build a single-arch nginx image for each arch. | |
| build-nginx-on-all-arches: | |
| name: build-nginx-all-arches | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| arch: [x86_64, aarch64] | |
| steps: | |
| - uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| check-latest: true | |
| - name: Setup QEMU | |
| uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 | |
| - run: | | |
| make apko | |
| ./apko build ./examples/nginx.yaml nginx:build /tmp/nginx-${{ matrix.arch }}.tar --arch ${{ matrix.arch }} | |
| - name: Check SBOM Conformance | |
| run: | | |
| set -euxo pipefail | |
| if ! ls *.spdx.json; then | |
| echo "no SBOMs found!" | |
| exit 1 | |
| fi | |
| for f in *.spdx.json; do | |
| echo ::group::sbom.json | |
| cat $f | |
| echo ::endgroup:: | |
| docker run --rm -v $(pwd)/$f:/$f --entrypoint "sh" cgr.dev/chainguard/wolfi-base -c "apk add spdx-tools-java && tools-java Verify /$f" | |
| done | |
| build-all-examples-one-arch: | |
| name: build-all-examples-amd64 | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| platform: [ubuntu-latest, macos-latest] | |
| runs-on: ${{ matrix.platform }} | |
| steps: | |
| - uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| check-latest: true | |
| - uses: imjasonh/setup-crane@6da1ae018866400525525ce74ff892880c099987 # v0.5 | |
| - run: | | |
| make apko | |
| for cfg in $(find ./examples/ -name '*.yaml'); do | |
| name=$(basename ${cfg} .yaml) | |
| echo "Building ${name}..." | |
| build_script=$(dirname ${cfg})/build.sh | |
| if [ -f ${build_script} ]; then | |
| ${build_script} ./apko | |
| else | |
| ./apko build ${cfg} ${name}:build /tmp/${name}.tar | |
| ./apko build --offline ${cfg} ${name}:build /tmp/${name}.tar | |
| fi | |
| done | |
| build-wolfi-source-date-epoch: | |
| name: source-date-epoch | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| check-latest: true | |
| - uses: chainguard-dev/actions/setup-registry@7440e20e3e0bb180a2f6e330bcd53504e2ac8980 # v1.6.8 | |
| with: | |
| port: 5000 | |
| - name: build image (w/ source date epoch) | |
| env: | |
| SOURCE_DATE_EPOCH: "0" | |
| run: | | |
| make apko | |
| FIRST=$(./apko publish ./examples/wolfi-base.yaml localhost:5000/wolfi --arch x86_64,aarch64 2> /dev/null) | |
| for idx in {2..10} | |
| do | |
| NEXT=$(./apko publish ./examples/wolfi-base.yaml localhost:5000/wolfi --arch x86_64,aarch64 2> /dev/null) | |
| if [ "${FIRST}" = "${NEXT}" ]; then | |
| echo "Build ${idx} matches." | |
| else | |
| echo "Build ${idx} differs: ${FIRST} and ${NEXT}" | |
| exit 1 | |
| fi | |
| done | |
| build-wolfi-build-date-epoch: | |
| name: build-date-epoch | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| check-latest: true | |
| - uses: chainguard-dev/actions/setup-registry@7440e20e3e0bb180a2f6e330bcd53504e2ac8980 # v1.6.8 | |
| with: | |
| port: 5000 | |
| - name: build image (w/ build date epoch) | |
| run: | | |
| make apko | |
| # Without SOURCE_DATE_EPOCH set, the timestamp of the image will be computed to be | |
| # the maximum build date of the resolved APKs. | |
| FIRST=$(./apko publish ./examples/wolfi-base.yaml localhost:5000/wolfi --arch x86_64,aarch64 2> /dev/null) | |
| for idx in {2..10} | |
| do | |
| NEXT=$(./apko publish ./examples/wolfi-base.yaml localhost:5000/wolfi --arch x86_64,aarch64 2> /dev/null) | |
| if [ "${FIRST}" = "${NEXT}" ]; then | |
| echo "Build ${idx} matches." | |
| else | |
| echo "Build ${idx} differs: ${FIRST} and ${NEXT}" | |
| exit 1 | |
| fi | |
| done | |
| annotations: | |
| name: annotations | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| check-latest: true | |
| - uses: imjasonh/setup-crane@6da1ae018866400525525ce74ff892880c099987 # v0.5 | |
| - uses: chainguard-dev/actions/setup-registry@7440e20e3e0bb180a2f6e330bcd53504e2ac8980 # v1.6.8 | |
| with: | |
| port: 5000 | |
| - run: | | |
| make apko | |
| # Build image with annotations. | |
| ref=$(./apko publish ./examples/nginx.yaml localhost:5000/nginx --arch x86_64,aarch64) | |
| # Check index annotations. | |
| crane manifest $ref | jq -r '.annotations.foo' | grep bar | |
| # Check per-image annotations. | |
| crane manifest --platform=linux/arm64 $ref | jq -r '.annotations.foo' | grep bar | |
| # Check per-image config labels. | |
| crane config --platform=linux/arm64 $ref | jq -r '.config.Labels' | grep bar | |
| certificates: | |
| name: certificates | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| check-latest: true | |
| - name: test additional certificates | |
| run: | | |
| ./hack/test-certificates.sh ./examples/certificates.yaml \ | |
| "E7:05:70:A9:89:F8:56:5A:AB:DF:7C:AE:27:AB:D1:62:18:72:D6:A3:F8:11:E3:FE:F2:7E:3D:BA:02:91:21:98" \ | |
| "9B:2A:33:9F:E6:A3:E8:55:85:C4:CD:75:53:6C:B8:C1:CF:7C:D6:03:B9:A6:4B:EC:25:21:85:8A:E4:8D:A8:5D" | |
| package-certificates: | |
| name: package-certificates | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| check-latest: true | |
| - name: test package-provided certificates | |
| run: | | |
| ./hack/test-certificates.sh ./examples/package-certificates.yaml \ | |
| "E7:05:70:A9:89:F8:56:5A:AB:DF:7C:AE:27:AB:D1:62:18:72:D6:A3:F8:11:E3:FE:F2:7E:3D:BA:02:91:21:98" \ | |
| "9B:2A:33:9F:E6:A3:E8:55:85:C4:CD:75:53:6C:B8:C1:CF:7C:D6:03:B9:A6:4B:EC:25:21:85:8A:E4:8D:A8:5D" \ | |
| "34:75:37:AF:7A:09:D4:03:F1:9F:58:F8:3C:35:68:91:2A:F2:4B:7C:12:E7:45:F1:D5:55:70:79:70:8C:91:AD" \ | |
| "12:AE:34:99:9A:A6:4D:CD:1A:69:47:E8:38:A5:3A:AB:AB:FC:FA:CA:45:AB:CA:8D:C0:CB:B8:DC:B7:BD:06:3C" |