Skip to content

Commit 8752533

Browse files
pdabelf5pdabelf5
authored
replace skopeo action with skopeo image (#5760)
1 parent d7e499c commit 8752533

File tree

9 files changed

+81
-91
lines changed

9 files changed

+81
-91
lines changed

‎.github/actions/install-skopeo/action.yml

Lines changed: 0 additions & 33 deletions
This file was deleted.

‎.github/scripts/copy-images.sh

Lines changed: 26 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,14 @@
22

33
set -eo pipefail
44

5+
# shellcheck disable=SC2155
6+
export ROOTDIR=$(git rev-parse --show-toplevel || echo ".")
7+
8+
SKOPEO_BIN=skopeo
9+
if [ -n "$CI" ]; then
10+
SKOPEO_BIN="docker run --rm -v $HOME/.docker/config.json:/tmp/auth.json $(grep skopeo "${ROOTDIR}/tests/Dockerfile" | grep FROM | cut -d ' ' -f 2)"
11+
fi
12+
513
## Setup inputs
614

715
SOURCE_TAG=${SOURCE_TAG:-stable}
@@ -31,22 +39,19 @@ SOURCE_NAP_WAF_IMAGE_PREFIX=${SOURCE_NAP_WAF_IMAGE_PREFIX:-"nginx-ic-nap/nginx-p
3139
SOURCE_NAP_WAFV5_IMAGE_PREFIX=${SOURCE_NAP_WAFV5_IMAGE_PREFIX:-"nginx-ic-nap-v5/nginx-plus-ingress"}
3240
SOURCE_NAP_DOS_IMAGE_PREFIX=${SOURCE_NAP_DOS_IMAGE_PREFIX:-"nginx-ic-dos/nginx-plus-ingress"}
3341
SOURCE_NAP_WAF_DOS_IMAGE_PREFIX=${SOURCE_NAP_WAF_DOS_IMAGE_PREFIX:-"nginx-ic-dos-nap/nginx-plus-ingress"}
34-
SOURCE_NAP_WAFV5_DOS_IMAGE_PREFIX=${SOURCE_NAP_WAFV5_DOS_IMAGE_PREFIX:-"nginx-ic-dos-nap-v5/nginx-plus-ingress"}
3542

3643
TARGET_PLUS_IMAGE_PREFIX=${TARGET_PLUS_IMAGE_PREFIX:-"nginx-ic/nginx-plus-ingress"}
3744
TARGET_NAP_WAF_IMAGE_PREFIX=${TARGET_NAP_WAF_IMAGE_PREFIX:-"nginx-ic-nap/nginx-plus-ingress"}
3845
TARGET_NAP_WAFV5_IMAGE_PREFIX=${TARGET_NAP_WAFV5_IMAGE_PREFIX:-"nginx-ic-nap/nginx-plus-ingress"}
3946
TARGET_NAP_DOS_IMAGE_PREFIX=${TARGET_NAP_DOS_IMAGE_PREFIX:-"nginx-ic-dos/nginx-plus-ingress"}
4047
TARGET_NAP_WAF_DOS_IMAGE_PREFIX=${TARGET_NAP_WAF_DOS_IMAGE_PREFIX:-"nginx-ic-dos-nap/nginx-plus-ingress"}
41-
TARGET_NAP_WAFV5_DOS_IMAGE_PREFIX=${TARGET_NAP_WAFV5_DOS_IMAGE_PREFIX:-"nginx-ic-dos-nap-v5/nginx-plus-ingress"}
4248

4349
declare -a OSS_TAG_POSTFIX_LIST=("" "-ubi" "-alpine")
4450
declare -a PLUS_TAG_POSTFIX_LIST=("" "-ubi" "-alpine" "-alpine-fips")
4551
declare -a NAP_WAF_TAG_POSTFIX_LIST=("" "-ubi" "-alpine-fips")
46-
declare -a NAP_WAFV5_TAG_POSTFIX_LIST=()
52+
declare -a NAP_WAFV5_TAG_POSTFIX_LIST=("" "-ubi" "-alpine-fips")
4753
declare -a NAP_DOS_TAG_POSTFIX_LIST=("" "-ubi")
4854
declare -a NAP_WAF_DOS_TAG_POSTFIX_LIST=("" "-ubi")
49-
declare -a NAP_WAFV5_DOS_TAG_POSTFIX_LIST=()
5055
declare -a ADDITIONAL_TAGS=("latest" "${ADDITIONAL_TAG}")
5156

5257
CONFIG_PATH=${CONFIG_PATH:-~/.nic-release/config}
@@ -89,7 +94,7 @@ if $PUBLISH_OSS; then
8994
new_tag=${TARGET_REGISTRY}/${TARGET_OSS_IMAGE_PREFIX}:${TARGET_TAG}${postfix}
9095
echo " Pushing image OSS ${new_tag}..."
9196
if ! $DRY_RUN; then
92-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
97+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
9398
fi
9499
for tag in "${ADDITIONAL_TAGS[@]}"; do
95100
if [ -z "${tag}" ]; then
@@ -98,7 +103,7 @@ if $PUBLISH_OSS; then
98103
additional_tag=${TARGET_REGISTRY}/${TARGET_OSS_IMAGE_PREFIX}:${tag}${postfix}
99104
echo " Pushing image OSS ${additional_tag}..."
100105
if ! $DRY_RUN; then
101-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
106+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
102107
fi
103108
done
104109
done
@@ -111,12 +116,12 @@ if $PUBLISH_PLUS; then
111116
image=${SOURCE_REGISTRY}/${SOURCE_PLUS_IMAGE_PREFIX}:${SOURCE_TAG}${postfix}
112117
echo "Processing image ${image}"
113118
new_tag=${TARGET_REGISTRY}/${TARGET_PLUS_IMAGE_PREFIX}:${TARGET_TAG}${postfix}
114-
if $IS_IMMUTABLE && skopeo --override-os linux --override-arch amd64 inspect docker://${new_tag} > /dev/null 2>&1; then
119+
if $IS_IMMUTABLE && ${SKOPEO_BIN} --override-os linux --override-arch amd64 inspect docker://${new_tag} > /dev/null 2>&1; then
115120
echo " ECR is immutable & tag ${new_tag} already exists, skipping."
116121
else
117122
echo " Pushing image Plus ${new_tag}..."
118123
if ! $DRY_RUN; then
119-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
124+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
120125
fi
121126
for tag in "${ADDITIONAL_TAGS[@]}"; do
122127
if [ -z "${tag}" ]; then
@@ -125,7 +130,7 @@ if $PUBLISH_PLUS; then
125130
additional_tag=${TARGET_REGISTRY}/${TARGET_PLUS_IMAGE_PREFIX}:${tag}${postfix}
126131
echo " Pushing image Plus ${additional_tag}..."
127132
if ! $DRY_RUN; then
128-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
133+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
129134
fi
130135
done
131136
fi
@@ -139,12 +144,12 @@ if $PUBLISH_WAF; then
139144
image=${SOURCE_REGISTRY}/${SOURCE_NAP_WAF_IMAGE_PREFIX}:${SOURCE_TAG}${postfix}
140145
echo "Processing image ${image}"
141146
new_tag=${TARGET_REGISTRY}/${TARGET_NAP_WAF_IMAGE_PREFIX}:${TARGET_TAG}${postfix}
142-
if $IS_IMMUTABLE && skopeo --override-os linux --override-arch amd64 inspect docker://${new_tag} > /dev/null 2>&1; then
147+
if $IS_IMMUTABLE && ${SKOPEO_BIN} --override-os linux --override-arch amd64 inspect docker://${new_tag} > /dev/null 2>&1; then
143148
echo " ECR is immutable & tag ${new_tag} already exists, skipping."
144149
else
145150
echo " Pushing image NAP WAF ${new_tag}..."
146151
if ! $DRY_RUN; then
147-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
152+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
148153
fi
149154
for tag in "${ADDITIONAL_TAGS[@]}"; do
150155
if [ -z "${tag}" ]; then
@@ -153,7 +158,7 @@ if $PUBLISH_WAF; then
153158
additional_tag=${TARGET_REGISTRY}/${TARGET_NAP_WAF_IMAGE_PREFIX}:${tag}${postfix}
154159
echo " Pushing image NAP WAF ${additional_tag}..."
155160
if ! $DRY_RUN; then
156-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
161+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
157162
fi
158163
done
159164
fi
@@ -162,12 +167,12 @@ if $PUBLISH_WAF; then
162167
image=${SOURCE_REGISTRY}/${SOURCE_NAP_WAFV5_IMAGE_PREFIX}:${SOURCE_TAG}${postfix}
163168
echo "Processing image ${image}"
164169
new_tag=${TARGET_REGISTRY}/${TARGET_NAP_WAFV5_IMAGE_PREFIX}:${TARGET_TAG}${postfix}
165-
if $IS_IMMUTABLE && skopeo --override-os linux --override-arch amd64 inspect docker://${new_tag} > /dev/null 2>&1; then
170+
if $IS_IMMUTABLE && ${SKOPEO_BIN} --override-os linux --override-arch amd64 inspect docker://${new_tag} > /dev/null 2>&1; then
166171
echo " ECR is immutable & tag ${new_tag} already exists, skipping."
167172
else
168173
echo " Pushing image NAP WAFV5 ${new_tag}..."
169174
if ! $DRY_RUN; then
170-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
175+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
171176
fi
172177
for tag in "${ADDITIONAL_TAGS[@]}"; do
173178
if [ -z "${tag}" ]; then
@@ -176,7 +181,7 @@ if $PUBLISH_WAF; then
176181
additional_tag=${TARGET_REGISTRY}/${TARGET_NAP_WAFV5_IMAGE_PREFIX}:${tag}${postfix}
177182
echo " Pushing image NAP WAFV5 ${additional_tag}..."
178183
if ! $DRY_RUN; then
179-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
184+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
180185
fi
181186
done
182187
fi
@@ -190,12 +195,12 @@ if $PUBLISH_DOS; then
190195
image=${SOURCE_REGISTRY}/${SOURCE_NAP_DOS_IMAGE_PREFIX}:${SOURCE_TAG}${postfix}
191196
echo "Processing image ${image}"
192197
new_tag=${TARGET_REGISTRY}/${TARGET_NAP_DOS_IMAGE_PREFIX}:${TARGET_TAG}${postfix}
193-
if $IS_IMMUTABLE && skopeo --override-os linux --override-arch amd64 inspect docker://${new_tag} > /dev/null 2>&1; then
198+
if $IS_IMMUTABLE && ${SKOPEO_BIN} --override-os linux --override-arch amd64 inspect docker://${new_tag} > /dev/null 2>&1; then
194199
echo " ECR is immutable & tag ${new_tag} already exists, skipping."
195200
else
196201
echo " Pushing image NAP DOS ${new_tag}..."
197202
if ! $DRY_RUN; then
198-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
203+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
199204
fi
200205
for tag in "${ADDITIONAL_TAGS[@]}"; do
201206
if [ -z "${tag}" ]; then
@@ -204,7 +209,7 @@ if $PUBLISH_DOS; then
204209
additional_tag=${TARGET_REGISTRY}/${TARGET_NAP_DOS_IMAGE_PREFIX}:${tag}${postfix}
205210
echo " Pushing image NAP DOS ${additional_tag}..."
206211
if ! $DRY_RUN; then
207-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
212+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
208213
fi
209214
done
210215
fi
@@ -218,12 +223,12 @@ if $PUBLISH_WAF_DOS; then
218223
image=${SOURCE_REGISTRY}/${SOURCE_NAP_WAF_DOS_IMAGE_PREFIX}:${SOURCE_TAG}${postfix}
219224
echo "Processing image ${image}"
220225
new_tag=${TARGET_REGISTRY}/${TARGET_NAP_WAF_DOS_IMAGE_PREFIX}:${TARGET_TAG}${postfix}
221-
if $IS_IMMUTABLE && skopeo --override-os linux --override-arch amd64 inspect docker://${new_tag} > /dev/null 2>&1; then
226+
if $IS_IMMUTABLE && ${SKOPEO_BIN} --override-os linux --override-arch amd64 inspect docker://${new_tag} > /dev/null 2>&1; then
222227
echo " ECR is immutable & tag ${new_tag} already exists, skipping."
223228
else
224229
echo " Pushing image NAP WAF/DOS ${new_tag}..."
225230
if ! $DRY_RUN; then
226-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
231+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${new_tag}
227232
fi
228233
for tag in "${ADDITIONAL_TAGS[@]}"; do
229234
if [ -z "${tag}" ]; then
@@ -232,7 +237,7 @@ if $PUBLISH_WAF_DOS; then
232237
additional_tag=${TARGET_REGISTRY}/${TARGET_NAP_WAF_DOS_IMAGE_PREFIX}:${tag}${postfix}
233238
echo " Pushing image NAP WAF/DOS ${additional_tag}..."
234239
if ! $DRY_RUN; then
235-
skopeo copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
240+
${SKOPEO_BIN} copy --retry-times 5 ${ARCH_OPTS} ${SOURCE_OPTS} ${TARGET_OPTS} docker://${image} docker://${additional_tag}
236241
fi
237242
done
238243
fi

‎.github/scripts/create-release-tarballs.sh

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
#!/usr/bin/env bash
2+
3+
set -e
4+
5+
directory=$1
6+
version=$2
7+
tarball_dir=${TARBALL_DIR:-tarballs}
8+
releases=$(find "${directory}" -mindepth 1 -type d)
9+
syft_binary=${SYFT_BIN:-"syft"}
10+
cosign_binary=${COSIGN_BIN:-"cosign"}
11+
12+
if [ ! -d "${tarball_dir}" ]; then
13+
mkdir "${tarball_dir}"
14+
fi
15+
16+
for i in ${releases}; do
17+
# fix for v1 in kubernetes-ingress_linux_amd64_v1
18+
if [[ ${i} =~ v1 ]]; then
19+
mv "${i}" "${i%*_v1}"
20+
i=${i%*_v1}
21+
fi
22+
23+
if [[ ${i} =~ aws ]]; then
24+
continue
25+
fi
26+
product_name=$(basename "${i}" | cut -d '_' -f 1)
27+
product_arch=$(echo "${i}" | cut -d '_' -f 2-)
28+
product_release="${product_name}_${version}_${product_arch}"
29+
# shellcheck disable=SC2086
30+
tarball_name="${tarball_dir}/${product_release}.tar.gz"
31+
cp -r "${i}" "${directory}/${product_release}"
32+
cp README.md LICENSE CHANGELOG.md "${directory}/${product_release}"
33+
34+
tar -czf "${tarball_name}" "${directory}/${product_release}"
35+
${syft_binary} scan file:"${directory}/${product_release}/nginx-ingress" -o spdx-json > "${tarball_name}.spdx.json"
36+
pushd "${tarball_dir}"
37+
sha256sum "${product_release}.tar.gz" >> "${product_name}_${version}_checksums.txt"
38+
sha256sum "${product_release}.tar.gz.spdx.json" >> "${product_name}_${version}_checksums.txt"
39+
popd
40+
done
41+
42+
checksum_file=$(ls "${tarball_dir}"/*_checksums.txt )
43+
${cosign_binary} sign-blob "${checksum_file}" --output-signature="${checksum_file}.sig" --output-certificate="${checksum_file}.pem" -y

‎.github/workflows/oss-release.yml

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -94,9 +94,6 @@ jobs:
9494
username: oauth2accesstoken
9595
password: ${{ steps.gcr-auth.outputs.access_token }}
9696

97-
- name: Install latest skopeo
98-
uses: ./.github/actions/install-skopeo
99-
10097
- name: Publish OSS images
10198
run: |
10299
export CONFIG_PATH=.github/config/config-oss-gcr-release
@@ -147,9 +144,6 @@ jobs:
147144
with:
148145
registry: public.ecr.aws
149146

150-
- name: Install latest skopeo
151-
uses: ./.github/actions/install-skopeo
152-
153147
- name: Publish images
154148
run: |
155149
export CONFIG_PATH=.github/config/config-oss-ecr
@@ -195,9 +189,6 @@ jobs:
195189
username: ${{ secrets.DOCKER_USERNAME }}
196190
password: ${{ secrets.DOCKER_PASSWORD }}
197191

198-
- name: Install latest skopeo
199-
uses: ./.github/actions/install-skopeo
200-
201192
- name: Publish images
202193
run: |
203194
export CONFIG_PATH=.github/config/config-oss-dockerhub
@@ -244,9 +235,6 @@ jobs:
244235
username: ${{ secrets.QUAY_USERNAME }}
245236
password: ${{ secrets.QUAY_ROBOT_TOKEN }}
246237

247-
- name: Install latest skopeo
248-
uses: ./.github/actions/install-skopeo
249-
250238
- name: Publish images
251239
run: |
252240
export CONFIG_PATH=.github/config/config-oss-quay
@@ -294,9 +282,6 @@ jobs:
294282
username: ${{ github.repository_owner }}
295283
password: ${{ secrets.GITHUB_TOKEN }}
296284

297-
- name: Install latest skopeo
298-
uses: ./.github/actions/install-skopeo
299-
300285
- name: Publish images
301286
run: |
302287
export CONFIG_PATH=.github/config/config-oss-github

‎.github/workflows/plus-release.yml

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -94,9 +94,6 @@ jobs:
9494
username: oauth2accesstoken
9595
password: ${{ steps.gcr-auth.outputs.access_token }}
9696

97-
- name: Install latest skopeo
98-
uses: ./.github/actions/install-skopeo
99-
10097
- name: Publish Plus images
10198
run: |
10299
export CONFIG_PATH=.github/config/config-plus-gcr-release
@@ -151,9 +148,6 @@ jobs:
151148
username: ${{ steps.idtoken.outputs.id_token }}
152149
password: ${{ github.actor }}
153150

154-
- name: Install latest skopeo
155-
uses: ./.github/actions/install-skopeo
156-
157151
- name: Publish images
158152
run: |
159153
export CONFIG_PATH=.github/config/config-plus-nginx
@@ -194,9 +188,6 @@ jobs:
194188
workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY_MKTPL }}
195189
service_account: ${{ secrets.GCR_SERVICE_ACCOUNT_MKTPL }}
196190

197-
- name: Install latest skopeo
198-
uses: ./.github/actions/install-skopeo
199-
200191
- name: Publish Plus images
201192
run: |
202193
export CONFIG_PATH=.github/config/config-plus-gcr-public
@@ -249,9 +240,6 @@ jobs:
249240
with:
250241
registry: 709825985650.dkr.ecr.us-east-1.amazonaws.com
251242

252-
- name: Install latest skopeo
253-
uses: ./.github/actions/install-skopeo
254-
255243
- name: Publish images
256244
run: |
257245
export CONFIG_PATH=.github/config/config-plus-ecr
@@ -295,9 +283,6 @@ jobs:
295283
username: ${{ secrets.AZ_MKTPL_ID }}
296284
password: ${{ secrets.AZ_MKTPL_SECRET }}
297285

298-
- name: Install latest skopeo
299-
uses: ./.github/actions/install-skopeo
300-
301286
- name: Publish images
302287
run: |
303288
export CONFIG_PATH=.github/config/config-plus-azure

0 commit comments

Comments
 (0)