Auto generated from templates by gromit

.github/workflows/release.yml

@@ -32,15 +32,15 @@ jobs:
       fail-fast: false
       matrix:
         golang_cross:
-          - 1.21-bullseye
+          - 1.21-bookworm
         include:
-          - golang_cross: 1.21-bullseye
+          - golang_cross: 1.21-bookworm
             goreleaser: 'ci/goreleaser/goreleaser.yml'
             cgo: 0
             rpmvers: 'el/7 el/8 el/9 amazon/2 amazon/2023'
             debvers: 'ubuntu/xenial ubuntu/bionic ubuntu/focal ubuntu/jammy debian/jessie debian/buster debian/bullseye debian/bookworm'
     outputs:
-      tags: ${{ steps.metadata.outputs.tags }}
+      tags: ${{ steps.ci_metadata.outputs.tags }}
       commit_author: ${{ steps.fetch-author.outputs.commit_author}}
     steps:
       - name: Checkout of tyk-pump
@@ -83,7 +83,7 @@ jobs:
           ci/bin/unlock-agent.sh
           git config --global url."https://${{ secrets.ORG_GH_TOKEN }}@github.com".insteadOf "https://github.com"
           git config --global --add safe.directory /go/src/github.com/TykTechnologies/tyk-pump
-          goreleaser release --clean -f ${{ matrix.goreleaser }} ${{ !startsWith(github.ref, 'refs/tags/') && ' --snapshot --skip-sign' || '' }}' | tee /tmp/build.sh
+          goreleaser release --clean -f ${{ matrix.goreleaser }} ${{ !startsWith(github.ref, 'refs/tags/') && ' --snapshot --skip=sign' || '' }}' | tee /tmp/build.sh
           chmod +x /tmp/build.sh
           docker run --rm --privileged -e GITHUB_TOKEN=${{ github.token }} \
           -e GOPRIVATE=github.com/TykTechnologies                                \
@@ -113,12 +113,12 @@ jobs:
           mask-aws-account-id: false
       - uses: aws-actions/amazon-ecr-login@v2
         id: ecr
-        if: ${{ matrix.golang_cross == '1.21-bullseye' }}
+        if: ${{ matrix.golang_cross == '1.21-bookworm' }}
         with:
           mask-password: 'true'
       - name: Docker metadata for CI
-        id: metadata
-        if: ${{ matrix.golang_cross == '1.21-bullseye' }}
+        id: ci_metadata
+        if: ${{ matrix.golang_cross == '1.21-bookworm' }}
         uses: docker/metadata-action@v5
         with:
           images: ${{ steps.ecr.outputs.registry }}/tyk-pump
@@ -131,10 +131,10 @@ jobs:
             type=semver,pattern=v{{major}}.{{minor}},prefix=v
             type=semver,pattern=v{{version}},prefix=v
       - name: CI push
-        if: ${{ matrix.golang_cross == '1.21-bullseye' }}
+        if: ${{ matrix.golang_cross == '1.21-bookworm' }}
         shell: bash
         env:
-          t: ${{ steps.metadata.outputs.tags }}
+          t: ${{ steps.ci_metadata.outputs.tags }}
           build_tag: ${{ startswith(github.ref, 'refs/tags') && github.ref_name || 'v0.0.0' }}
         run: |
           set +e
@@ -146,15 +146,15 @@ jobs:
              docker manifest create ${tag} ${tag}-amd64 ${tag}-arm64 && docker manifest push ${tag}
           done
       - uses: actions/upload-artifact@v4
-        if: ${{ matrix.golang_cross == '1.21-bullseye' }}
+        if: ${{ matrix.golang_cross == '1.21-bookworm' }}
         with:
           name: deb
           retention-days: 1
           path: |
             dist/*.deb
             !dist/*PAYG*.deb
       - uses: actions/upload-artifact@v4
-        if: ${{ matrix.golang_cross == '1.21-bullseye' }}
+        if: ${{ matrix.golang_cross == '1.21-bookworm' }}
         with:
           name: rpm
           retention-days: 1
@@ -353,6 +353,46 @@ jobs:
           SLACK_USERNAME: API INTEGRATION TESTS
           SLACK_MESSAGE: "*Test*: ${{ matrix.db }}-${{ matrix.conf }}, *Author*: ${{ steps.fetch_slack_user.outputs.slack-user-name }}"
           SLACK_FOOTER: "<https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|SEE EXECUTION DETAILS HERE>"
+  distroless:
+    runs-on: ubuntu-latest
+    needs: goreleaser
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+      - uses: actions/download-artifact@v4
+        with:
+          name: deb
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - name: Docker metadata for distroless
+        id: distroless_metadata
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            tykio/tyk-pump-docker-pub
+            docker.tyk.io/tyk-pump/tyk-pump
+          flavor: |
+            latest=false
+            prefix=s
+          tags: |
+            type=semver,pattern={{major}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{version}}
+          labels: |
+            org.opencontainers.image.title=tyk-pump (distroless)
+            org.opencontainers.image.description=Tyk Analytics Pump to move analytics data from Redis to any supported back end (multiple back ends can be written to at once).
+            org.opencontainers.image.vendor=tyk.io
+            org.opencontainers.image.version=$GITHUB_REF_NAME
+      - name: build distroless image
+        uses: docker/build-push-action@v5
+        with:
+          context: "."
+          platforms: linux/amd64,linux/arm64
+          file: ci/Dockerfile.distroless
+          push: ${{ startsWith(github.ref, 'refs/tags') }}
+          tags: ${{ steps.distroless_metadata.outputs.tags }}
+          labels: ${{ steps.distroless_metadata.outputs.labels }}
   upgrade-deb:
     services:
       httpbin.org:
@@ -366,6 +406,7 @@ jobs:
           - amd64
           - arm64
         distro:
+          - ubuntu:xenial
           - ubuntu:bionic
           - ubuntu:focal
           - ubuntu:jammy
@@ -409,6 +450,8 @@ jobs:
           - amazonlinux:2023
           - registry.access.redhat.com/ubi8/ubi
           - registry.access.redhat.com/ubi9/ubi
+          - amazonlinux:2
+          - registry.access.redhat.com/ubi7/ubi
     steps:
       - uses: actions/checkout@v4
         with:

ci/Dockerfile.distroless

@@ -0,0 +1,20 @@
+# Generated by: gromit policy
+
+FROM debian:bookworm-slim  as DEB 
+ARG TARGETARCH
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+COPY *${TARGETARCH}.deb /
+RUN dpkg -i /tyk-pump*${TARGETARCH}.deb && rm /*.deb
+
+FROM gcr.io/distroless/static-debian12
+
+COPY --from=DEB /opt/tyk-pump /opt/tyk-pump
+
+ARG PORTS
+EXPOSE $PORTS
+
+WORKDIR /opt/tyk-pump/
+ENTRYPOINT ["/opt/tyk-pump/tyk-pump" ]
+CMD [ "--conf=/opt/tyk-pump/pump.conf" ]

ci/Dockerfile.std

@@ -1,6 +1,6 @@
 # Generated by: gromit policy
 
-FROM debian:bullseye-slim
+FROM debian:bookworm-slim
 ARG TARGETARCH
 
 ENV DEBIAN_FRONTEND=noninteractive