fix: harden Docker image build and release with digest pinning and checksum verification #285
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: build | |
| on: | |
| pull_request: | |
| env: | |
| go-version: 1.26 | |
| jobs: | |
| build: | |
| name: Build images | |
| strategy: | |
| matrix: | |
| include: | |
| - ubuntu-version: "22.04" | |
| digest-dockerhub-ubuntu: sha256:962f6cadeae0ea6284001009daa4cc9a8c37e75d1f5191cf0eb83fe565b63dd7 | |
| digest-minimal: sha256:81507f913e77df078ce75b14d5d3cd42a314f335f7ced90a2d4c2864f7bbbd4b | |
| digest-ubuntu: sha256:fa38c1f1a65e0a98dc29b0c527454fde447e66b7617364a190c366a5e5d27560 | |
| - ubuntu-version: "24.04" | |
| digest-dockerhub-ubuntu: sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b | |
| digest-minimal: sha256:eb18868c75bbebaa11138382cd1dad8ac008a10cdecd4476da12c777b752498c | |
| digest-ubuntu: sha256:73fdd894bc00d9f1b8b65ae6eeaae25d600d3c54464898eed194d31ad8a7f50e | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| env: | |
| DIGEST_DOCKERHUB_UBUNTU: ${{ matrix.digest-dockerhub-ubuntu }} | |
| DIGEST_MINIMAL: ${{ matrix.digest-minimal }} | |
| DIGEST_UBUNTU: ${{ matrix.digest-ubuntu }} | |
| defaults: | |
| run: | |
| working-directory: ${{ matrix.ubuntu-version }} | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Setup golang | |
| uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 | |
| with: | |
| go-version: ${{ env.go-version }} | |
| - name: Build images | |
| run: | | |
| TAG_MINIMAL=$(cat TAG_MINIMAL) | |
| TAG=$(cat TAG) | |
| echo "TAG_MINIMAL=$TAG_MINIMAL" | |
| echo "TAG=$TAG" | |
| echo "DIGEST_MINIMAL=$DIGEST_MINIMAL" | |
| echo "DIGEST_DOCKERHUB_UBUNTU=$DIGEST_DOCKERHUB_UBUNTU" | |
| echo "DIGEST_UBUNTU=$DIGEST_UBUNTU" | |
| echo | |
| echo "building ubuntu-minimal:$TAG_MINIMAL..." | |
| docker build \ | |
| -t ghcr.io/cybozu/ubuntu-minimal:$TAG_MINIMAL \ | |
| --build-arg TAG_MINIMAL=$TAG_MINIMAL \ | |
| --build-arg DIGEST_DOCKERHUB_UBUNTU=$DIGEST_DOCKERHUB_UBUNTU \ | |
| ubuntu-minimal | |
| echo | |
| echo "building ubuntu:$TAG..." | |
| docker build \ | |
| -t ghcr.io/cybozu/ubuntu:$TAG \ | |
| --build-arg TAG=$TAG \ | |
| --build-arg DIGEST_MINIMAL=$DIGEST_MINIMAL \ | |
| ubuntu | |
| for image in ubuntu-dev ubuntu-debug; do | |
| echo | |
| echo "building $image:$TAG..." | |
| docker build \ | |
| -t ghcr.io/cybozu/${image}:$TAG \ | |
| --build-arg TAG=$TAG \ | |
| --build-arg DIGEST_UBUNTU=$DIGEST_UBUNTU \ | |
| ${image} | |
| done |