eps-devcontainers/.github/workflows/build_all_images.yml at 11f14ca099ce30d5b3119493deaba4e0548ca752 · NHSDigital/eps-devcontainers · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
name: build_all_images
'on':
  workflow_call:
    inputs:
      docker_tag:
        required: true
        type: string
      tag_latest:
        required: true
        type: boolean
      NO_CACHE:
        required: true
        type: boolean
permissions: {}
jobs:
  discover_folders:
    runs-on: ubuntu-22.04
    outputs:
      base_node_folders: ${{ steps.find-folders.outputs.base_node }}
      node_24_language_folders: ${{ steps.find-folders.outputs.node_24_languages }}
      project_folders: ${{ steps.find-folders.outputs.projects }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          persist-credentials: false

      - id: find-folders
        run: |
          base_node_folders=$(find src/base_node -mindepth 1 -maxdepth 1 -type d -printf '%f\n' | jq -R -s -c 'split("\n")[:-1]')
          node_24_language_folders=$(find src/languages -mindepth 1 -maxdepth 1 -type d -name 'node_24*' -printf '%f\n' | jq -R -s -c 'split("\n")[:-1]')
          project_folders=$(find src/projects -mindepth 1 -maxdepth 1 -type d -printf '%f\n' | jq -R -s -c 'split("\n")[:-1]')
          {
            echo "base_node=$base_node_folders"
            echo "node_24_languages=$node_24_language_folders"
            echo "projects=$project_folders"
          } >> "$GITHUB_OUTPUT"

  build_tool_images:
    # build common tool images with a lower scoped github token
    # as it uses a 3rd party docker image with github cli installed to verify attestation of tflint binary
    # and we dont want to make a high scoped token available to that image
    # token needs attestation read so it can verify attestation of tflint binary
    name: Build tool images for on ${{ matrix.arch }}
    runs-on: '${{ matrix.runner }}'
    strategy:
      fail-fast: false
      matrix:
        include:
          - arch: amd64
            runner: ubuntu-22.04
          - arch: arm64
            runner: ubuntu-22.04-arm
    permissions:
      contents: read
      attestations: read
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: build_grype
        run: |
          make build-grype
          docker save "local_grype:latest" -o grype_image.tar
      - name: build_syft
        run: |
          make build-syft
          docker save "local_syft:latest" -o syft_image.tar
      - name: build_grant
        run: |
          make build-grant
          docker save "local_grant:latest" -o grant_image.tar

      - name: build_tflint
        run: |
          make build-tflint
          docker save "local_tflint:latest" -o tflint_image.tar
        env:
            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
        name: Upload docker images
        with:
          name: docker_artifact_${{ matrix.arch }}
          path: |
            grype_image.tar
            syft_image.tar
            grant_image.tar
            tflint_image.tar
  package_base_docker_image:
    uses: ./.github/workflows/build_multi_arch_image.yml
    permissions:
      attestations: write
      contents: read
      packages: write
      id-token: write
    needs: [build_tool_images]
    with:
      tag_latest: ${{ inputs.tag_latest }}
      docker_tag: ${{ inputs.docker_tag }}
      container_name: base
      base_folder: "."
      NO_CACHE: ${{ inputs.NO_CACHE }}
  package_base_node_images:
    needs:
      - package_base_docker_image
      - discover_folders
    permissions:
      attestations: write
      contents: read
      packages: write
      id-token: write
    strategy:
      fail-fast: false
      matrix:
            container_name: ${{ fromJson(needs.discover_folders.outputs.base_node_folders) }}
    uses: ./.github/workflows/build_multi_arch_image.yml
    with:
      tag_latest: ${{ inputs.tag_latest }}
      docker_tag: ${{ inputs.docker_tag }}
      container_name: ${{ matrix.container_name }}
      base_folder: "base_node"
      NO_CACHE: ${{ inputs.NO_CACHE }}
      EXTRA_COMMON: "common_node_24"
  package_node_24_language_docker_images:
    needs:
      - package_base_docker_image
      - package_base_node_images
      - discover_folders
    permissions:
      attestations: write
      contents: read
      packages: write
      id-token: write
    strategy:
      fail-fast: false
      matrix:
            container_name: ${{ fromJson(needs.discover_folders.outputs.node_24_language_folders) }}
    uses: ./.github/workflows/build_multi_arch_image.yml
    with:
      tag_latest: ${{ inputs.tag_latest }}
      docker_tag: ${{ inputs.docker_tag }}
      container_name: ${{ matrix.container_name }}
      base_folder: "languages"
      NO_CACHE: ${{ inputs.NO_CACHE }}
      EXTRA_COMMON: "common_node_24"
  package_project_docker_images:
    needs:
      - package_node_24_language_docker_images
      - discover_folders
    permissions:
      attestations: write
      contents: read
      packages: write
      id-token: write
    strategy:
      fail-fast: false
      matrix:
        container_name: ${{ fromJson(needs.discover_folders.outputs.project_folders) }}
    uses: ./.github/workflows/build_multi_arch_image.yml
    with:
      tag_latest: ${{ inputs.tag_latest }}
      docker_tag: ${{ inputs.docker_tag }}
      container_name: ${{ matrix.container_name }}
      base_folder: "projects"
      NO_CACHE: ${{ inputs.NO_CACHE }}
      EXTRA_COMMON: "common_node_24"