DevOps Toolchains

[jonrau1]

Ahead of #123 (which is not a blocker, as you can use docker CLI to pass in a new file to the Docker runtime, in this case external_providers.toml) there is a bunch of house keeping that needs to be done which requires a mix of stupid ideas.

I don't like GitHub Actions, because I am not good at writing GitHub Actions...so I want to use CodeBuild to offload some tasks

CI Automation Needed

• sbom: I hate that I admit this, but since ElectricEye can run in Governmental partitions with AWS, and due to new regulations and whatever, some fedbois will need a SBOM of ElectricEye and other people like them too. grype and syft are available with Actions so that may be a GHA. Need to figure out if I can write the SBOM back into the file structure
• gcr: Use CodeBuild or GHA to write an image to GCR
• ecr-public` Use CodeBuild or GHA to write an image to ECR Public
• ocr: Use CodeBuild or GHA to write an image to Oracle Cloud Container Registry
• dockerhub Same thing...write it to Dockerhub instead

Would be cool to display build badges, can easily do that with CodeBuild. It is probably the better bet using AWS Secrets Manager to contain the details of other clouds than storing in GitHub Secrets which I don't really like.

One day I need to get ElectricEye working in PyPI as well...