forked from kyverno/reports-server
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #47 from nirmata/workflow-tag-update
add tag update
- Loading branch information
Showing
4 changed files
with
82 additions
and
162 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -35,65 +35,12 @@ jobs: | |
| echo "Detected architecture: $ARCH" | ||
| echo "ARCH=$ARCH" >> $GITHUB_ENV | ||
| - name: Print Disk & Memory Usage (Before Cleanup) | ||
| run: | | ||
| echo "==== Disk Usage Before Cleanup ($ARCH) ====" | ||
| df -h | ||
| echo "==== Memory Usage Before Cleanup ($ARCH) ====" | ||
| free -h | ||
| echo "==== Docker Disk Usage Before Cleanup ($ARCH) ====" | ||
| docker system df | ||
| - name: Cleanup Space on Runner | ||
| run: | | ||
| echo "Running cleanup for $ARCH..." | ||
| # Remove unnecessary packages | ||
| sudo apt-get autoremove -y | ||
| sudo apt-get clean | ||
| # Remove dangling Docker images & containers | ||
| # docker system prune -af --volumes | ||
| # Remove cached Go modules | ||
| go clean -modcache | ||
| # Remove unnecessary system logs | ||
| sudo journalctl --vacuum-time=1s | ||
| # Remove npm cache (if applicable) | ||
| rm -rf ~/.npm | ||
| rm -rf ~/.cache | ||
| # Extra cleanup for ARM64 (if needed) | ||
| if [[ "$ARCH" == "aarch64" ]]; then | ||
| echo "Applying additional cleanup for ARM64..." | ||
| # Add ARM64-specific cleanup commands here if needed | ||
| fi | ||
| - name: Print Disk & Memory Usage (After Cleanup) | ||
| run: | | ||
| echo "==== Disk Usage After Cleanup ($ARCH) ====" | ||
| df -h | ||
| echo "==== Memory Usage After Cleanup ($ARCH) ====" | ||
| free -h | ||
| echo "==== Docker Disk Usage After Cleanup ($ARCH) ====" | ||
| docker system df | ||
| - name: Checkout release | ||
| if: ${{ inputs.tag == 'release'}} | ||
| uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # v2.4.0 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Checkout image | ||
| if: ${{ inputs.tag == 'image'}} | ||
| uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # v2.4.0 | ||
|
|
||
| - name: Unshallow | ||
| if: ${{ inputs.tag == 'image'}} | ||
| run: git fetch --prune --unshallow --tags | ||
|
|
||
| - name: Set up Go | ||
| uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2 | ||
| with: | ||
|
|
@@ -116,9 +63,12 @@ jobs: | |
| registry: ghcr.io | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
| # - name: Set up QEMU | ||
| # # if: runner.arch != 'X64' # Only set up QEMU on non-x86_64 architectures | ||
| # uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a # v3.3.0 | ||
| - name: Set up binfmt | ||
| uses: docker/[email protected] | ||
|
|
||
| - name: Install binfmt | ||
| run: | | ||
| docker run --rm --privileged tonistiigi/binfmt --install all | ||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 #v3.8.0 | ||
| id: buildx | ||
|
|
@@ -153,31 +103,13 @@ jobs: | |
| name: ${{inputs.image_name}}-bom-cdx | ||
| path: ${{inputs.image_name}}-v*-bom.cdx.json | ||
|
|
||
| - name: Extract branch name | ||
| if: ${{inputs.tag == 'image'}} | ||
| shell: bash | ||
| run: echo "##[set-output name=branch;]$(echo ${GITHUB_REF#refs/heads/})" | ||
| id: extract_branch | ||
|
|
||
| - name: Check branch | ||
| if: ${{inputs.tag == 'image' && steps.extract_branch.outputs.branch != 'main'}} | ||
| id: check-branch | ||
| run: | | ||
| if [[ ${{ steps.extract_branch.outputs.branch }} =~ ^release-[0-9]+\.[0-9]$ ]]; then | ||
| echo ::set-output name=match::true | ||
| fi | ||
| - name: Debug Inputs | ||
| run: | | ||
| echo "Tag: ${{ inputs.tag }}" | ||
| echo "publish_command : ${{ inputs.publish_command}}" | ||
| echo "Digest Command: ${{ inputs.digest_command }}" | ||
| echo "Image Name: ${{ inputs.image_name }}" | ||
| echo "Repository: ${{ github.repository }}" | ||
| echo "Workflow: ${{ github.workflow }}" | ||
| echo "SHA: ${{ github.sha }}" | ||
| echo "secrets.GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}" | ||
| echo "github.actor: ${{ github.actor }}" | ||
| echo "Branch: ${{ steps.extract_branch.outputs.branch }}" | ||
| - name: Docker images publish | ||
| if: ${{inputs.tag == 'image' && steps.extract_branch.outputs.branch == 'main'}} | ||
| run: make ${{inputs.publish_command}} FIPS_ENABLED=1 | ||
|
|
@@ -189,14 +121,14 @@ jobs: | |
| digest=$(make ${{inputs.digest_command}} FIPS_ENABLED=1) | ||
| echo "digest=${digest}" >> $GITHUB_ENV | ||
| - name: Docker release-images publish | ||
| if: ${{inputs.tag == 'release' || inputs.tag == 'image' }} | ||
| if: ${{inputs.tag == 'release' }} | ||
| run: make ${{inputs.publish_command}} FIPS_ENABLED=1 | ||
|
|
||
| - name: Clear Sigstore TUF Cache | ||
| run: | | ||
| rm -rf ~/.sigstore | ||
| - name: Get release-image digest | ||
| if: ${{ inputs.tag == 'release' || (inputs.tag == 'image' && steps.check-branch.outputs.match == 'true') }} | ||
| if: ${{ inputs.tag == 'release' }} | ||
| id: get-step | ||
| run: | | ||
| digest=$(make ${{inputs.digest_command}} FIPS_ENABLED=1 2>/dev/null || true) | ||
|
|
@@ -213,17 +145,6 @@ jobs: | |
| echo "Error: Digest is empty or invalid." >&2 | ||
| exit 1 | ||
| fi | ||
| - name: Sign image | ||
| if: ${{ inputs.tag == 'image' && steps.extract_branch.outputs.branch == 'main' }} | ||
| env: | ||
| COSIGN_EXPERIMENTAL: "true" | ||
| COSIGN_REPOSITORY: "ghcr.io/${{ github.repository_owner }}/${{ github.repository }}/signatures" | ||
| run: | | ||
| cosign sign --yes \ | ||
| -a "repo=${{ github.repository }}" \ | ||
| -a "workflow=${{ github.workflow }}" \ | ||
| -a "ref=${{ github.sha }}" \ | ||
| ghcr.io/${{ github.repository_owner }}/${{ inputs.image_name }}@sha256:${digest} | ||
| - name: Sign release-image | ||
| if: ${{ inputs.tag == 'release' || (inputs.tag == 'image' && steps.check-branch.outputs.match == 'true') }} | ||
| env: | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters