nandi.uk
Fork of daniellemaywood.uk/gleam — Wasm codegen work
3.9 kB
110 lines
1name: "Build Gleam"
2description: "Build Gleam Container"
3inputs:
4 version:
5 description: "Build Version"
6 required: true
7 release-id:
8 description: "Release ID"
9 required: true
10
11runs:
12 using: composite
13 steps:
14 - name: Download Gleam release assets
15 uses: robinraju/release-downloader@daf26c55d821e836577a15f77d86ddc078948b05 # v1.12
16 with:
17 releaseId: "${{ inputs.release-id }}"
18 fileName: "gleam-${{ inputs.version }}-{x86_64-unknown-linux-musl,aarch64-unknown-linux-musl}.*"
19
20 - name: "Unpack release files into correct location"
21 shell: bash
22 run: |
23 declare -A ARCH
24 ARCH["amd64"]="x86_64-unknown-linux-musl"
25 ARCH["arm64"]="aarch64-unknown-linux-musl"
26
27 for SHORT in "${!ARCH[@]}"; do
28 LONG="${ARCH[$SHORT]}"
29
30 # Unpack Release
31 tar xf "gleam-$VERSION-$LONG.tar.gz"
32
33 # Move files into place
34 mv gleam "gleam-$SHORT"
35
36 # The SBoM is added to the images so that the Docker Scout Scanner is
37 # able to find the info about the gleam binary since it was not
38 # installed by the operating system package manager.
39 mv "gleam-$VERSION-$LONG.tar.gz.sbom.spdx.json" "gleam-$SHORT.sbom.spdx.json"
40
41 # Delete Unused Files
42 rm -rf "gleam-$VERSION-$LONG*"
43 done
44 env:
45 VERSION: "${{ inputs.version }}"
46
47 - name: Authenticate with GitHub container registry
48 uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
49 with:
50 registry: ghcr.io
51 username: ${{ github.actor }}
52 password: ${{ github.token }}
53
54 - name: Set up Docker Buildx
55 uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
56
57 - name: Build version and tags
58 shell: bash
59 id: versions
60 run: |
61 # Build version with platform
62 PLATFORM_VERSION=$VERSION_VERSION-${{ matrix.base-image }}
63
64 # Build container tag
65 TAG=ghcr.io/${{ github.repository }}:$PLATFORM_VERSION
66
67 echo "platform-version=$PLATFORM_VERSION" >> $GITHUB_OUTPUT
68 echo "container-tag=$TAG" >> $GITHUB_OUTPUT
69 env:
70 VERSION: "${{ inputs.version }}"
71
72 - name: Build and push
73 uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
74 with:
75 context: .
76 platforms: linux/amd64,linux/arm64
77 file: containers/${{ matrix.base-image }}.dockerfile
78 push: true
79
80 # Enabling `provenance` will cause the action to create SLSA build
81 # provenance and push it alongside the tagged image. In practical terms,
82 # we're adding info to the tag that attests to where, when, and how the
83 # asset and image was built.
84 #
85 # For more info on Docker Attestations, see:
86 # https://docs.docker.com/build/ci/github-actions/attestations/
87 provenance: true
88
89 # Enabling `sbom` will trigger an SBoM Scan using Docker Scout:
90 # https://docs.docker.com/scout/how-tos/view-create-sboms/
91 # The scan will detect any operating system packages as well as the Gleam
92 # Build SBoM added into the Docker Container.
93 #
94 # Why is this helpful?
95 # * If you build services on top of these container images, you can track
96 # all dependencies that ship with Gleam, plus the rest of your stack in
97 # the image.
98 # * This makes it easier to do image-level vulnerability scans and
99 # compliance checks.
100 #
101 # For more info on Docker SBoMs, see:
102 # https://docs.docker.com/build/metadata/attestations/sbom/
103 sbom: true
104 tags: ${{ steps.versions.outputs.container-tag }}
105 labels: |
106 org.opencontainers.image.title=gleam
107 org.opencontainers.image.url=https://gleam.run
108 org.opencontainers.image.source=https://github.com/gleam-lang/gleam
109 org.opencontainers.image.version=${{ steps.versions.outputs.platform-version }}
110 org.opencontainers.image.licenses=Apache-2.0