-
Notifications
You must be signed in to change notification settings - Fork 0
79 lines (79 loc) · 3.04 KB
/
build.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
name: Build and push ostree containers
on:
workflow_dispatch:
schedule:
- cron: '0 19 * * 6'
push:
branches:
- 'main'
- 'test'
- 'stage'
- 'next'
jobs:
build-push-base-image:
name: Build and push baseline workstation image
runs-on: ubuntu-latest
timeout-minutes: 60
permissions:
contents: read
id-token: write
packages: write
steps:
- name: checkout repo
uses: actions/checkout@v3
- name: cosign-installer
uses: sigstore/[email protected]
- name: build base image
id: build-base-image
uses: redhat-actions/buildah-build@v2
with:
image: fedora-silverblue-ws
tags: 38-${{ github.ref_name }} ${{ github.sha }}
containerfiles: ./Containerfile.workstation
- name: push base image
id: push-base-image
uses: redhat-actions/push-to-registry@v2
with:
image: ${{ steps.build-base-image.outputs.image }}
tags: ${{ steps.build-base-image.outputs.tags }}
registry: ghcr.io/${{ github.repository_owner }}
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: cosign login (rh push-to-registry does not login)
run: cosign login ghcr.io -u ${{ github.repository_owner }} -p ${{ secrets.GITHUB_TOKEN }}
- name: sign base container image with sigstore fulcio and github oidc
run: cosign sign --yes ghcr.io/${{ github.repository_owner }}/${{ steps.build-base-image.outputs.image }}@${{ steps.push-base-image.outputs.digest }}
build-push-nvidia-image:
name: Build and push nvidia workstation image
needs: build-push-base-image
runs-on: ubuntu-latest
timeout-minutes: 60
permissions:
contents: read
id-token: write
packages: write
steps:
- name: checkout repo
uses: actions/checkout@v3
- name: cosign-installer
uses: sigstore/[email protected]
- name: build nvidia image
id: build-nvidia-image
uses: redhat-actions/buildah-build@v2
with:
image: fedora-silverblue-ws
tags: 38-nvidia-${{ github.ref_name }} ${{ github.sha }}-nvidia
containerfiles: ./Containerfile.nvidia
- name: push nvidia image
id: push-nvidia-image
uses: redhat-actions/push-to-registry@v2
with:
image: ${{ steps.build-nvidia-image.outputs.image }}
tags: ${{ steps.build-nvidia-image.outputs.tags }}
registry: ghcr.io/${{ github.repository_owner }}
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: cosign login (rh push-to-registry does not login)
run: cosign login ghcr.io -u ${{ github.repository_owner }} -p ${{ secrets.GITHUB_TOKEN }}
- name: sign nvidia container image with sigstore fulcio and github oidc
run: cosign sign --yes ghcr.io/${{ github.repository_owner }}/${{ steps.build-nvidia-image.outputs.image }}@${{ steps.push-nvidia-image.outputs.digest }}