Skip to content
Docker

feat: derive provider count from eyrie registry, drop legacy credential naming #514

Sign in to view logs

feat: derive provider count from eyrie registry, drop legacy credential naming

feat: derive provider count from eyrie registry, drop legacy credential naming #514

Workflow file for this run

.github/workflows/docker.yml at d101510
name: Docker
on:
push:
branches: [main]
tags: ["v*"]
pull_request:
branches: [main]
paths:
- "Dockerfile"
- "internal/sandbox/container_version"
- "internal/sandbox/sandbox.Dockerfile"
- "**.go"
- "go.mod"
- "go.sum"
permissions:
contents: read
packages: write
security-events: write
env:
REGISTRY: ghcr.io
IMAGE_NAME: graycodeai/hawk
jobs:
# Build each platform natively on its own runner (arm64 natively via the
# ubuntu-24.04-arm runner instead of QEMU emulation, which took ~28 min for
# the multi-arch push build). The two jobs run in parallel; merge-manifest
# then combines the per-platform images into the shared multi-arch tags.
# A cache mount in the Dockerfile (persisted through cache-to: gha, mode=max)
# keeps per-commit rebuilds to a relink instead of a cold Go compile.
build-amd64:
name: build + scan (amd64)
runs-on: ubuntu-latest
outputs:
image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:amd64-${{ github.sha }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
# Pull the pinned ecosystem submodules under external/ so the Docker
# build compiles against the integrated revisions, not each repo's main.
submodules: recursive
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
- name: Log in to GHCR
if: github.event_name != 'pull_request'
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
# Build a single-platform image locally first so Trivy can gate the push:
# CRITICAL/HIGH findings fail this job before anything reaches GHCR.
- name: Build image for scan
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
with:
context: .
platforms: linux/amd64
push: false
load: true
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:scan
cache-from: type=gha,scope=hawk-amd64
cache-to: type=gha,mode=max,scope=hawk-amd64
build-args: |
VERSION=${{ github.ref_name }}
COMMIT=${{ github.sha }}
BUILD_DATE=${{ github.event.head_commit.timestamp }}
- name: Scan image with Trivy
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
with:
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:scan
format: sarif
output: trivy-image.sarif
severity: CRITICAL
ignore-unfixed: true
exit-code: '0' # Don't fail the build; results are uploaded for review
# Second build is a cache hit (layers exported by the scan build), so it
# only re-links and pushes the platform image.
- name: Build and push (amd64)
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
with:
context: .
platforms: linux/amd64
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:amd64-${{ github.sha }}
cache-from: type=gha,scope=hawk-amd64
cache-to: type=gha,mode=max,scope=hawk-amd64
build-args: |
VERSION=${{ github.ref_name }}
COMMIT=${{ github.sha }}
BUILD_DATE=${{ github.event.head_commit.timestamp }}
- name: Upload Trivy image scan results
if: github.event_name != 'pull_request' && always()
uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
with:
sarif_file: trivy-image.sarif
build-arm64:
name: build + scan (arm64)
runs-on: ubuntu-24.04-arm
outputs:
image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:arm64-${{ github.sha }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
with:
# Pull the pinned ecosystem submodules under external/ so the Docker
# build compiles against the integrated revisions, not each repo's main.
submodules: recursive
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
- name: Log in to GHCR
if: github.event_name != 'pull_request'
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
# Build a single-platform image locally first so Trivy can gate the push:
# CRITICAL/HIGH findings fail this job before anything reaches GHCR.
- name: Build image for scan
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
with:
context: .
platforms: linux/arm64
push: false
load: true
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:scan
cache-from: type=gha,scope=hawk-arm64
cache-to: type=gha,mode=max,scope=hawk-arm64
build-args: |
VERSION=${{ github.ref_name }}
COMMIT=${{ github.sha }}
BUILD_DATE=${{ github.event.head_commit.timestamp }}
- name: Scan image with Trivy
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
with:
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:scan
format: sarif
output: trivy-image.sarif
severity: CRITICAL
ignore-unfixed: true
exit-code: '0' # Don't fail the build; results are uploaded for review
# Second build is a cache hit (layers exported by the scan build), so it
# only re-links and pushes the platform image.
- name: Build and push (arm64)
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
with:
context: .
platforms: linux/arm64
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:arm64-${{ github.sha }}
cache-from: type=gha,scope=hawk-arm64
cache-to: type=gha,mode=max,scope=hawk-arm64
build-args: |
VERSION=${{ github.ref_name }}
COMMIT=${{ github.sha }}
BUILD_DATE=${{ github.event.head_commit.timestamp }}
- name: Upload Trivy image scan results
if: github.event_name != 'pull_request' && always()
uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
with:
sarif_file: trivy-image.sarif
merge-manifest:
name: merge multi-arch manifest
if: github.event_name != 'pull_request'
needs: [build-amd64, build-arm64]
runs-on: ubuntu-latest
steps:
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
- name: Log in to GHCR
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Docker metadata
id: meta
uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
tags: |
type=ref,event=branch
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
type=sha,prefix=sha-,format=long
# Point every shared tag (main, sha-<long>, semver) at a manifest list
# covering both platform images pushed by the native jobs.
- name: Merge per-platform images into multi-arch tags
run: |
set -euo pipefail
src="${{ needs.build-amd64.outputs.image }} ${{ needs.build-arm64.outputs.image }}"
printf '%s\n' "${{ steps.meta.outputs.tags }}" | while IFS= read -r tag; do
if [ -n "$tag" ]; then
docker buildx imagetools create -t "$tag" $src
fi
done
sandbox-image:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- name: Read sandbox image version
id: sandbox-version
shell: bash
run: echo "tag=$(tr -d '[:space:]' < internal/sandbox/container_version)" >> "$GITHUB_OUTPUT"
- name: Set up QEMU
uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
- name: Log in to GHCR
if: github.event_name != 'pull_request'
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Build sandbox image for scan
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
with:
context: internal/sandbox
file: internal/sandbox/sandbox.Dockerfile
platforms: linux/amd64
push: false
load: true
tags: ${{ env.REGISTRY }}/graycodeai/hawk-sandbox:scan
cache-from: type=gha,scope=hawk-sandbox
cache-to: type=gha,mode=max,scope=hawk-sandbox
- name: Scan sandbox image
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
with:
image-ref: ${{ env.REGISTRY }}/graycodeai/hawk-sandbox:scan
format: sarif
output: trivy-sandbox-image.sarif
severity: CRITICAL
ignore-unfixed: true
exit-code: '0'
- name: Build and publish public sandbox image
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
with:
context: internal/sandbox
file: internal/sandbox/sandbox.Dockerfile
platforms: linux/amd64,linux/arm64
push: ${{ github.event_name != 'pull_request' }}
tags: |
${{ env.REGISTRY }}/graycodeai/hawk-sandbox:${{ steps.sandbox-version.outputs.tag }}
${{ env.REGISTRY }}/graycodeai/hawk-sandbox:latest
cache-from: type=gha,scope=hawk-sandbox
cache-to: type=gha,mode=max,scope=hawk-sandbox
- name: Upload sandbox image scan results
if: github.event_name != 'pull_request' && always()
uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
with:
sarif_file: trivy-sandbox-image.sarif