Skip to content

Commit 485e46b

Browse files
tonistiigitonistiigi
authored
Merge pull request #3453 from crazy-max/mount-github-event
docker-container: write github actions payload to container for provenance
2 parents 805c377 + 7652057 commit 485e46b

File tree

14 files changed

+2600
-17
lines changed

14 files changed

+2600
-17
lines changed

‎driver/docker-container/driver.go‎

Lines changed: 27 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ import (
1616
"github.com/docker/buildx/driver"
1717
"github.com/docker/buildx/driver/bkimage"
1818
"github.com/docker/buildx/util/confutil"
19+
"github.com/docker/buildx/util/ghutil"
1920
"github.com/docker/buildx/util/imagetools"
2021
"github.com/docker/buildx/util/progress"
2122
"github.com/docker/cli/cli/context/docker"
@@ -43,20 +44,21 @@ type Driver struct {
4344

4445
// if you add fields, remember to update docs:
4546
// https://github.com/docker/docs/blob/main/content/build/drivers/docker-container.md
46-
netMode string
47-
image string
48-
memory opts.MemBytes
49-
memorySwap opts.MemSwapBytes
50-
cpuQuota int64
51-
cpuPeriod int64
52-
cpuShares int64
53-
cpusetCpus string
54-
cpusetMems string
55-
cgroupParent string
56-
restartPolicy container.RestartPolicy
57-
env []string
58-
defaultLoad bool
59-
gpus []container.DeviceRequest
47+
netMode string
48+
image string
49+
memory opts.MemBytes
50+
memorySwap opts.MemSwapBytes
51+
cpuQuota int64
52+
cpuPeriod int64
53+
cpuShares int64
54+
cpusetCpus string
55+
cpusetMems string
56+
cgroupParent string
57+
restartPolicy container.RestartPolicy
58+
env []string
59+
defaultLoad bool
60+
gpus []container.DeviceRequest
61+
writeProvenanceGHA bool
6062
}
6163

6264
func (d *Driver) IsMobyDriver() bool {
@@ -137,6 +139,17 @@ func (d *Driver) create(ctx context.Context, l progress.SubLogger) error {
137139
},
138140
}
139141

142+
if d.writeProvenanceGHA {
143+
if ghactx, err := ghutil.GithubActionsContext(); err != nil {
144+
return err
145+
} else if ghactx != nil {
146+
if d.Files == nil {
147+
d.Files = make(map[string][]byte)
148+
}
149+
d.Files["provenance.d/github_actions_context.json"] = ghactx
150+
}
151+
}
152+
140153
// Mount WSL libaries if running in WSL environment and Docker context
141154
// is a local socket as requesting GPU on container builder creation
142155
// is not enough when generating the CDI specification for GPU devices.

‎driver/docker-container/factory.go‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,9 +47,10 @@ func (f *factory) New(ctx context.Context, cfg driver.InitConfig) (driver.Driver
4747
return nil, err
4848
}
4949
d := &Driver{
50-
factory: f,
51-
InitConfig: cfg,
52-
restartPolicy: rp,
50+
factory: f,
51+
InitConfig: cfg,
52+
restartPolicy: rp,
53+
writeProvenanceGHA: true,
5354
}
5455
var gpus dockeropts.GpuOpts
5556
if err := gpus.Set("all"); err == nil {
@@ -111,6 +112,11 @@ func (f *factory) New(ctx context.Context, cfg driver.InitConfig) (driver.Driver
111112
return nil, errors.Errorf("invalid env option %q, expecting env.FOO=bar", k)
112113
}
113114
d.env = append(d.env, fmt.Sprintf("%s=%s", envName, v))
115+
case k == "provenance-add-gha":
116+
d.writeProvenanceGHA, err = strconv.ParseBool(v)
117+
if err != nil {
118+
return nil, err
119+
}
114120
default:
115121
return nil, errors.Errorf("invalid driver option %s for docker-container driver", k)
116122
}

‎tests/create.go‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package tests
33
import (
44
"fmt"
55
"os"
6+
"path/filepath"
67
"strings"
78
"testing"
89

@@ -23,6 +24,7 @@ var createTests = []func(t *testing.T, sb integration.Sandbox){
2324
testCreateMemoryLimit,
2425
testCreateRestartAlways,
2526
testCreateRemoteContainer,
27+
testCreateWithProvenanceGHA,
2628
}
2729

2830
func testCreateMemoryLimit(t *testing.T, sb integration.Sandbox) {
@@ -108,3 +110,31 @@ func testCreateRemoteContainer(t *testing.T, sb integration.Sandbox) {
108110
}
109111
require.Fail(t, "remote builder is not running")
110112
}
113+
114+
func testCreateWithProvenanceGHA(t *testing.T, sb integration.Sandbox) {
115+
if !isDockerContainerWorker(sb) {
116+
t.Skip("only testing with docker-container worker")
117+
}
118+
119+
var builderName string
120+
t.Cleanup(func() {
121+
if builderName == "" {
122+
return
123+
}
124+
out, err := rmCmd(sb, withArgs(builderName))
125+
require.NoError(t, err, out)
126+
})
127+
128+
ghep := filepath.Join(t.TempDir(), "event.json")
129+
require.NoError(t, os.WriteFile(ghep, []byte(`{"test":{"foo":"bar"}}`), 0644))
130+
131+
out, err := createCmd(sb,
132+
withArgs("--driver", "docker-container"),
133+
withEnv("GITHUB_ACTIONS=true", "GITHUB_EVENT_NAME=push", "GITHUB_EVENT_PATH="+ghep),
134+
)
135+
require.NoError(t, err, out)
136+
builderName = strings.TrimSpace(out)
137+
138+
out, err = inspectCmd(sb, withArgs(builderName, "--bootstrap"))
139+
require.NoError(t, err, out)
140+
}

‎util/ghutil/fixtures/ghactx_pr.env‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
ACCEPT_EULA=Y
2+
ACTIONS_RUNNER_ACTION_ARCHIVE_CACHE=/opt/actionarchivecache
3+
AGENT_TOOLSDIRECTORY=/opt/hostedtoolcache
4+
ANDROID_HOME=/usr/local/lib/android/sdk
5+
ANDROID_NDK=/usr/local/lib/android/sdk/ndk/27.3.13750724
6+
ANDROID_NDK_HOME=/usr/local/lib/android/sdk/ndk/27.3.13750724
7+
ANDROID_NDK_LATEST_HOME=/usr/local/lib/android/sdk/ndk/28.2.13676358
8+
ANDROID_NDK_ROOT=/usr/local/lib/android/sdk/ndk/27.3.13750724
9+
ANDROID_SDK_ROOT=/usr/local/lib/android/sdk
10+
ANT_HOME=/usr/share/ant
11+
AZURE_EXTENSION_DIR=/opt/az/azcliextensions
12+
BOOTSTRAP_HASKELL_NONINTERACTIVE=1
13+
CHROMEWEBDRIVER=/usr/local/share/chromedriver-linux64
14+
CHROME_BIN=/usr/bin/google-chrome
15+
CI=true
16+
CONDA=/usr/share/miniconda
17+
DEBIAN_FRONTEND=noninteractive
18+
DOTNET_MULTILEVEL_LOOKUP=0
19+
DOTNET_NOLOGO=1
20+
DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
21+
EDGEWEBDRIVER=/usr/local/share/edge_driver
22+
ENABLE_RUNNER_TRACING=true
23+
GECKOWEBDRIVER=/usr/local/share/gecko_driver
24+
GHCUP_INSTALL_BASE_PREFIX=/usr/local
25+
GITHUB_ACTION=__run
26+
GITHUB_ACTIONS=true
27+
GITHUB_ACTION_REF=
28+
GITHUB_ACTION_REPOSITORY=
29+
GITHUB_ACTOR=crazy-max
30+
GITHUB_ACTOR_ID=1951866
31+
GITHUB_API_URL=https://api.github.com
32+
GITHUB_BASE_REF=master
33+
GITHUB_ENV=/home/runner/work/_temp/_runner_file_commands/set_env_33a5ccf0-43cf-4794-91bc-98abed829158
34+
GITHUB_EVENT_NAME=pull_request
35+
GITHUB_EVENT_PATH=./fixtures/ghactx_pr_event.json
36+
GITHUB_GRAPHQL_URL=https://api.github.com/graphql
37+
GITHUB_HEAD_REF=ghutil
38+
GITHUB_JOB=ghutil
39+
GITHUB_OUTPUT=/home/runner/work/_temp/_runner_file_commands/set_output_33a5ccf0-43cf-4794-91bc-98abed829158
40+
GITHUB_PATH=/home/runner/work/_temp/_runner_file_commands/add_path_33a5ccf0-43cf-4794-91bc-98abed829158
41+
GITHUB_REF=refs/pull/55/merge
42+
GITHUB_REF_NAME=55/merge
43+
GITHUB_REF_PROTECTED=false
44+
GITHUB_REF_TYPE=branch
45+
GITHUB_REPOSITORY=docker/test-docker-action
46+
GITHUB_REPOSITORY_ID=285789493
47+
GITHUB_REPOSITORY_OWNER=docker
48+
GITHUB_REPOSITORY_OWNER_ID=5429470
49+
GITHUB_RETENTION_DAYS=90
50+
GITHUB_RUN_ATTEMPT=1
51+
GITHUB_RUN_ID=18774179609
52+
GITHUB_RUN_NUMBER=2
53+
GITHUB_SERVER_URL=https://github.com
54+
GITHUB_SHA=198c644a687204e604c8476ad23d7d5bbb0dc221
55+
GITHUB_STATE=/home/runner/work/_temp/_runner_file_commands/save_state_33a5ccf0-43cf-4794-91bc-98abed829158
56+
GITHUB_STEP_SUMMARY=/home/runner/work/_temp/_runner_file_commands/step_summary_33a5ccf0-43cf-4794-91bc-98abed829158
57+
GITHUB_TRIGGERING_ACTOR=crazy-max
58+
GITHUB_WORKFLOW=ghutil
59+
GITHUB_WORKFLOW_REF=docker/test-docker-action/.github/workflows/ghutil.yml@refs/pull/55/merge
60+
GITHUB_WORKFLOW_SHA=198c644a687204e604c8476ad23d7d5bbb0dc221
61+
GITHUB_WORKSPACE=/home/runner/work/test-docker-action/test-docker-action
62+
GOROOT_1_22_X64=/opt/hostedtoolcache/go/1.22.12/x64
63+
GOROOT_1_23_X64=/opt/hostedtoolcache/go/1.23.12/x64
64+
GOROOT_1_24_X64=/opt/hostedtoolcache/go/1.24.7/x64
65+
GRADLE_HOME=/usr/share/gradle-9.1.0
66+
HOME=/home/runner
67+
HOMEBREW_CLEANUP_PERIODIC_FULL_DAYS=3650
68+
HOMEBREW_NO_AUTO_UPDATE=1
69+
INVOCATION_ID=d3fd0f4a6372458dbf53aa6d6abd62b0
70+
ImageOS=ubuntu24
71+
ImageVersion=20250929.60.1
72+
JAVA_HOME=/usr/lib/jvm/temurin-17-jdk-amd64
73+
JAVA_HOME_11_X64=/usr/lib/jvm/temurin-11-jdk-amd64
74+
JAVA_HOME_17_X64=/usr/lib/jvm/temurin-17-jdk-amd64
75+
JAVA_HOME_21_X64=/usr/lib/jvm/temurin-21-jdk-amd64
76+
JAVA_HOME_25_X64=/usr/lib/jvm/temurin-25-jdk-amd64
77+
JAVA_HOME_8_X64=/usr/lib/jvm/temurin-8-jdk-amd64
78+
JOURNAL_STREAM=9:12643
79+
LANG=C.UTF-8
80+
LOGNAME=runner
81+
MEMORY_PRESSURE_WATCH=/sys/fs/cgroup/system.slice/hosted-compute-agent.service/memory.pressure
82+
MEMORY_PRESSURE_WRITE=c29tZSAyMDAwMDAgMjAwMDAwMAA=
83+
NVM_DIR=/home/runner/.nvm
84+
PATH=/snap/bin:/home/runner/.local/bin:/opt/pipx_bin:/home/runner/.cargo/bin:/home/runner/.config/composer/vendor/bin:/usr/local/.ghcup/bin:/home/runner/.dotnet/tools:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
85+
PIPX_BIN_DIR=/opt/pipx_bin
86+
PIPX_HOME=/opt/pipx
87+
POWERSHELL_DISTRIBUTION_CHANNEL=GitHub-Actions-ubuntu24
88+
RUNNER_ARCH=X64
89+
RUNNER_ENVIRONMENT=github-hosted
90+
RUNNER_NAME=GitHub Actions 1002237010
91+
RUNNER_OS=Linux
92+
RUNNER_TEMP=/home/runner/work/_temp
93+
RUNNER_TOOL_CACHE=/opt/hostedtoolcache
94+
RUNNER_TRACKING_ID=github_aef5ac41-9cf7-4195-9da9-851d8b29e68e
95+
RUNNER_WORKSPACE=/home/runner/work/test-docker-action
96+
SELENIUM_JAR_PATH=/usr/share/java/selenium-server.jar
97+
SGX_AESM_ADDR=1
98+
SHELL=/bin/bash
99+
SHLVL=1
100+
SWIFT_PATH=/usr/share/swift/usr/bin
101+
SYSTEMD_EXEC_PID=1762
102+
USER=runner
103+
VCPKG_INSTALLATION_ROOT=/usr/local/share/vcpkg
104+
XDG_CONFIG_HOME=/home/runner/.config
105+
XDG_RUNTIME_DIR=/run/user/1001
106+
_=/usr/bin/env

0 commit comments

Comments
 (0)