nandi.uk
Fork of daniellemaywood.uk/gleam — Wasm codegen work
3.8 kB
113 lines
1name: "Build Gleam"
2description: "Build Gleam Container"
3inputs:
4 version:
5 description: "Build Version"
6 required: true
7 release-id:
8 description: "Release ID"
9 required: true
10
11runs:
12 using: composite
13 steps:
14 - name: Download Gleam release assets
15 uses: robinraju/release-downloader@v1
16 with:
17 releaseId: "${{ inputs.release-id }}"
18 fileName: "gleam-${{ inputs.version }}-{x86_64-unknown-linux-musl,aarch64-unknown-linux-musl}.*"
19
20 - name: "Unpack release files into correct location"
21 shell: bash
22 run: |
23 declare -A ARCH
24 ARCH["amd64"]="x86_64-unknown-linux-musl"
25 ARCH["arm64"]="aarch64-unknown-linux-musl"
26
27 for SHORT in "${!ARCH[@]}"; do
28 LONG="${ARCH[$SHORT]}"
29
30 # Unpack Release
31 tar xf "gleam-$VERSION-$LONG.tar.gz"
32
33 # Move files into place
34 mv gleam "gleam-$SHORT"
35
36 # The SBoM is added to the images so that the Docker Scout Scanner is
37 # able to find the info about the gleam binary since it was not
38 # installed by the operating system package manager.
39 mv "gleam-$VERSION-$LONG.tar.gz.sbom.spdx.json" "gleam-$SHORT.sbom.spdx.json"
40
41 # Delete Unused Files
42 rm -rf "gleam-$VERSION-$LONG*"
43 done
44 env:
45 VERSION: "${{ inputs.version }}"
46
47 - name: Authenticate with GitHub container registry
48 uses: docker/login-action@v3
49 with:
50 registry: ghcr.io
51 username: ${{ github.actor }}
52 password: ${{ github.token }}
53
54 - name: Set up Docker Buildx
55 uses: docker/setup-buildx-action@v3
56
57 - name: Build version and tags
58 shell: bash
59 id: versions
60 run: |
61 # Strip `v` prefix from version
62 BARE_VERSION=$(echo "$VERSION" | sed -e 's|^v/\(.*\)|\1|')
63
64 # Build version with platform
65 PLATFORM_VERSION=$BARE_VERSION-${{ matrix.base-image }}
66
67 # Build container tag
68 TAG=ghcr.io/${{ github.repository }}:$PLATFORM_VERSION
69
70 echo "platform-version=$PLATFORM_VERSION" >> $GITHUB_OUTPUT
71 echo "container-tag=$TAG" >> $GITHUB_OUTPUT
72 env:
73 VERSION: "${{ inputs.version }}"
74
75 - name: Build and push
76 uses: docker/build-push-action@v6
77 with:
78 context: .
79 platforms: linux/amd64,linux/arm64
80 file: containers/${{ matrix.base-image }}.dockerfile
81 push: true
82
83 # Enabling `provenance` will cause the action to create SLSA build
84 # provenance and push it alongside the tagged image. In practical terms,
85 # we're adding info to the tag that attests to where, when, and how the
86 # asset and image was built.
87 #
88 # For more info on Docker Attestations, see:
89 # https://docs.docker.com/build/ci/github-actions/attestations/
90 provenance: true
91
92 # Enabling `sbom` will trigger an SBoM Scan using Docker Scout:
93 # https://docs.docker.com/scout/how-tos/view-create-sboms/
94 # The scan will detect any operating system packages as well as the Gleam
95 # Build SBoM added into the Docker Container.
96 #
97 # Why is this helpful?
98 # * If you build services on top of these container images, you can track
99 # all dependencies that ship with Gleam, plus the rest of your stack in
100 # the image.
101 # * This makes it easier to do image-level vulnerability scans and
102 # compliance checks.
103 #
104 # For more info on Docker SBoMs, see:
105 # https://docs.docker.com/build/metadata/attestations/sbom/
106 sbom: true
107 tags: ${{ steps.versions.outputs.container-tag }}
108 labels: |
109 org.opencontainers.image.title=gleam
110 org.opencontainers.image.url=https://gleam.run
111 org.opencontainers.image.source=https://github.com/gleam-lang/gleam
112 org.opencontainers.image.version=${{ steps.versions.outputs.platform-version }}
113 org.opencontainers.image.licenses=Apache-2.0