Skip to content

Use apko image on cgr #35

Use apko image on cgr

Use apko image on cgr #35

Workflow file for this run

name: ci
on:
pull_request:
env:
IMAGE_REPO: ttl.sh/test-${{ github.job }}-${{ github.run_id }}
APKO_CONFIG: https://raw.githubusercontent.com/chainguard-images/images/main/images/maven/config/template.apko.yaml
jobs:
ci:
runs-on: ubuntu-latest
steps:
- name: Harden Runner
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
with:
egress-policy: audit
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
- name: Build, sign, inspect an image using wolfi-act
uses: ./
with:
packages: curl,apko,cosign,crane,grype,trivy
command: |
set -x
# Download an apko config file
curl -L -o apko.yaml "${APKO_CONFIG}"
# Publish image using apko
apko publish apko.yaml "${IMAGE_REPO}" \
--repository-append=https://packages.wolfi.dev/os \
--keyring-append=https://packages.wolfi.dev/os/wolfi-signing.rsa.pub \
--package-append=wolfi-baselayout,maven,openjdk-17,openjdk-17-default-jvm \
--arch=x86_64,aarch64 \
--image-refs=apko.images.txt | tee apko.index.txt
index_digest="$(cat apko.index.txt)"
# Scan image with grype and trivy
grype "${index_digest}"
trivy image "${index_digest}"
# Tag image using crane
crane cp "${index_digest}" "${IMAGE_REPO}:latest"
- name: Make sure the image runs
run: |
set -x
docker run --rm -e JAVA_HOME=/usr/lib/jvm/java-17-openjdk "${IMAGE_REPO}:latest" --version
ci-debug:
runs-on: ubuntu-latest
steps:
- name: Harden Runner
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
with:
egress-policy: audit
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
- name: Build, sign, inspect an image using wolfi-act
uses: ./
with:
debug: "true"
packages: curl,apko,cosign,crane,grype,trivy
command: |
set -x
# Download an apko config file
curl -L -o apko.yaml "${APKO_CONFIG}"
# Publish image using apko
apko publish apko.yaml "${IMAGE_REPO}" \
--repository-append=https://packages.wolfi.dev/os \
--keyring-append=https://packages.wolfi.dev/os/wolfi-signing.rsa.pub \
--package-append=wolfi-baselayout,maven,openjdk-17,openjdk-17-default-jvm \
--arch=x86_64,aarch64 \
--image-refs=apko.images.txt | tee apko.index.txt
index_digest="$(cat apko.index.txt)"
# Scan image with grype and trivy
grype "${index_digest}"
trivy image "${index_digest}"
# Tag image using crane
crane cp "${index_digest}" "${IMAGE_REPO}:latest"
- name: Make sure the image runs
run: |
set -x
docker run --rm -e JAVA_HOME=/usr/lib/jvm/java-17-openjdk "${IMAGE_REPO}:latest" --version