mirror of
https://github.com/rosenpass/rosenpass.git
synced 2025-12-12 15:49:22 -08:00
3d724f04d4
This commits changes the CI for dependabot PRs such that initially, only the exemptions for cargo vet are regenerated and pushed to the PR. Only after that, all other workflows are triggered. This ensures that the CI result for dependabot PRs is properly presented on github.
300 lines
11 KiB
YAML
300 lines
11 KiB
YAML
name: Build Docker Images
|
|
|
|
# Run this job on all non-pull-request events,
|
|
# or if Docker-related files are changed in a pull request.
|
|
on:
|
|
push:
|
|
branches:
|
|
- "main"
|
|
tags:
|
|
- "v*"
|
|
pull_request:
|
|
paths:
|
|
- "docker/Dockerfile"
|
|
- ".github/workflows/docker.yaml"
|
|
branches:
|
|
- "main"
|
|
workflow_run:
|
|
workflows: [Regenerate cargo-vet exemptions for dependabot-PRs]
|
|
types:
|
|
- completed
|
|
paths:
|
|
- "docker/Dockerfile"
|
|
- ".github/workflows/docker.yaml"
|
|
branches:
|
|
- "main"
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
jobs:
|
|
# --------------------------------
|
|
# 1. BUILD & TEST
|
|
# --------------------------------
|
|
build-and-test-rp:
|
|
# Only run this for dependabot PRs if it's triggered by the workflow to regenerate cargo-vet exemptions
|
|
if: ${{ github.actor != 'dependabot[bot]' || github.event_name == 'workflow_run' }}
|
|
strategy:
|
|
matrix:
|
|
arch: [amd64, arm64]
|
|
runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
- name: Build (no push) and Load
|
|
id: build
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: docker/Dockerfile
|
|
# no pushing here, so we can test locally
|
|
push: false
|
|
# load the built image into the local Docker daemon on the runner
|
|
load: true
|
|
target: rosenpass
|
|
tags: rosenpass:test
|
|
platforms: linux/${{ matrix.arch }}
|
|
- name: Integration Test - Standalone Key Exchange
|
|
run: |
|
|
# Create separate workdirs
|
|
mkdir -p workdir-server workdir-client
|
|
|
|
# Create a Docker network
|
|
docker network create -d bridge rp
|
|
|
|
echo "=== GENERATE SERVER KEYS ==="
|
|
docker run --rm \
|
|
-v $PWD/workdir-server:/workdir \
|
|
rosenpass:test gen-keys \
|
|
--public-key=workdir/server-public \
|
|
--secret-key=workdir/server-secret
|
|
|
|
echo "=== GENERATE CLIENT KEYS ==="
|
|
docker run --rm \
|
|
-v $PWD/workdir-client:/workdir \
|
|
rosenpass:test gen-keys \
|
|
--public-key=workdir/client-public \
|
|
--secret-key=workdir/client-secret
|
|
|
|
echo "=== SHARE PUBLIC KEYS ==="
|
|
cp workdir-client/client-public workdir-server/client-public
|
|
cp workdir-server/server-public workdir-client/server-public
|
|
|
|
echo "=== START SERVER CONTAINER ==="
|
|
docker run -d --rm \
|
|
--name rpserver \
|
|
--network rp \
|
|
-v $PWD/workdir-server:/workdir \
|
|
rosenpass:test exchange \
|
|
private-key workdir/server-secret \
|
|
public-key workdir/server-public \
|
|
listen 0.0.0.0:9999 \
|
|
peer public-key workdir/client-public \
|
|
outfile workdir/server-sharedkey
|
|
|
|
# Get the container IP of the server
|
|
SERVER_IP=$(docker inspect --format='{{.NetworkSettings.Networks.rp.IPAddress}}' rpserver)
|
|
echo "SERVER_IP=$SERVER_IP"
|
|
|
|
echo "=== START CLIENT CONTAINER ==="
|
|
docker run -d --rm \
|
|
--name rpclient \
|
|
--network rp \
|
|
-v $PWD/workdir-client:/workdir \
|
|
rosenpass:test exchange \
|
|
private-key workdir/client-secret \
|
|
public-key workdir/client-public \
|
|
peer public-key workdir/server-public \
|
|
endpoint ${SERVER_IP}:9999 \
|
|
outfile workdir/client-sharedkey
|
|
|
|
echo "=== COMPARE SHARED KEYS ==="
|
|
echo "Waiting up to 30 seconds for the server to generate 'server-sharedkey'..."
|
|
for i in $(seq 1 30); do
|
|
if [ -f "workdir-server/server-sharedkey" ]; then
|
|
echo "server-sharedkey found!"
|
|
break
|
|
fi
|
|
sleep 1
|
|
done
|
|
sudo cmp workdir-server/server-sharedkey workdir-client/client-sharedkey
|
|
|
|
echo "Standalone Key Exchange test OK."
|
|
# --------------------------------
|
|
# 2. PUSH (only if tests pass)
|
|
# --------------------------------
|
|
docker-image-rp:
|
|
needs:
|
|
- build-and-test-rp
|
|
# Only run this job if it s triggered by by a push to the main branch or a version tag.
|
|
if: ${{ github.event_name != 'pull_request' && github.event_name != 'workflow_run' }}
|
|
# Use a matrix to build for both AMD64 and ARM64
|
|
strategy:
|
|
matrix:
|
|
arch: [amd64, arm64]
|
|
# Switch the runner based on the architecture
|
|
runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Docker meta
|
|
id: meta
|
|
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: ghcr.io/${{ github.repository_owner }}/rp
|
|
labels: |
|
|
maintainer=Karolin Varner <karo@cupdev.net>, wucke13 <wucke13@gmail.com>
|
|
org.opencontainers.image.authors=Karolin Varner <karo@cupdev.net>, wucke13 <wucke13@gmail.com>
|
|
org.opencontainers.image.title=Rosenpass
|
|
org.opencontainers.image.description=The rp command-line integrates Rosenpass and WireGuard to help you create a VPN
|
|
org.opencontainers.image.vendor=Rosenpass e.V.
|
|
org.opencontainers.image.licenses=MIT OR Apache-2.0
|
|
org.opencontainers.image.url=https://rosenpass.eu
|
|
org.opencontainers.image.documentation=https://rosenpass.eu/docs/
|
|
org.opencontainers.image.source=https://github.com/rosenpass/rosenpass
|
|
|
|
- name: Log in to registry
|
|
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Build and push by digest
|
|
id: build
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: docker/Dockerfile
|
|
push: ${{ github.event_name != 'pull_request' }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
tags: ghcr.io/${{ github.repository_owner }}/rp
|
|
target: rp
|
|
platforms: linux/${{ matrix.arch }}
|
|
outputs: type=image,push-by-digest=true,name-canonical=true,push=true
|
|
|
|
- name: Export digest
|
|
run: |
|
|
mkdir -p ${{ runner.temp }}/digests
|
|
digest="${{ steps.build.outputs.digest }}"
|
|
touch "${{ runner.temp }}/digests/${digest#sha256:}"
|
|
|
|
- name: Upload digest
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: digests-rp-${{ matrix.arch }}
|
|
path: ${{ runner.temp }}/digests/*
|
|
if-no-files-found: error
|
|
retention-days: 1
|
|
|
|
docker-image-rosenpass:
|
|
needs:
|
|
- build-and-test-rp
|
|
# Only run this job if it s triggered by by a push to the main branch or a version tag.
|
|
if: ${{ github.event_name != 'pull_request' && github.event_name != 'workflow_run' }}
|
|
# Use a matrix to build for both AMD64 and ARM64
|
|
strategy:
|
|
matrix:
|
|
arch: [amd64, arm64]
|
|
# Switch the runner based on the architecture
|
|
runs-on: ${{ matrix.arch == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Docker meta
|
|
id: meta
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: ghcr.io/${{ github.repository_owner }}/rosenpass
|
|
labels: |
|
|
maintainer=Karolin Varner <karo@cupdev.net>, wucke13 <wucke13@gmail.com>
|
|
org.opencontainers.image.authors=Karolin Varner <karo@cupdev.net>, wucke13 <wucke13@gmail.com>
|
|
org.opencontainers.image.title=Rosenpass
|
|
org.opencontainers.image.description=Reference implementation of the protocol rosenpass protocol
|
|
org.opencontainers.image.vendor=Rosenpass e.V.
|
|
org.opencontainers.image.licenses=MIT OR Apache-2.0
|
|
org.opencontainers.image.url=https://rosenpass.eu
|
|
org.opencontainers.image.documentation=https://rosenpass.eu/docs/
|
|
org.opencontainers.image.source=https://github.com/rosenpass/rosenpass
|
|
|
|
- name: Log in to registry
|
|
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Build and push by digest
|
|
id: build
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: docker/Dockerfile
|
|
push: ${{ github.event_name != 'pull_request' }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
tags: ghcr.io/${{ github.repository_owner }}/rosenpass
|
|
target: rosenpass
|
|
platforms: linux/${{ matrix.arch }}
|
|
outputs: type=image,push-by-digest=true,name-canonical=true,push=true
|
|
|
|
- name: Export digest
|
|
run: |
|
|
mkdir -p ${{ runner.temp }}/digests
|
|
digest="${{ steps.build.outputs.digest }}"
|
|
touch "${{ runner.temp }}/digests/${digest#sha256:}"
|
|
|
|
- name: Upload digest
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: digests-rosenpass-${{ matrix.arch }}
|
|
path: ${{ runner.temp }}/digests/*
|
|
if-no-files-found: error
|
|
retention-days: 1
|
|
|
|
merge-digests:
|
|
runs-on: ubuntu-latest
|
|
needs:
|
|
- docker-image-rosenpass
|
|
- docker-image-rp
|
|
if: ${{ github.event_name != 'pull_request' && github.event_name != 'workflow_run' }}
|
|
strategy:
|
|
matrix:
|
|
target: [rp, rosenpass]
|
|
steps:
|
|
- name: Download digests
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
path: ${{ runner.temp }}/digests
|
|
pattern: digests-${{ matrix.target }}-*
|
|
merge-multiple: true
|
|
|
|
- name: Log in to registry
|
|
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.repository_owner }} --password-stdin
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Docker meta
|
|
id: meta
|
|
uses: docker/metadata-action@v5
|
|
with:
|
|
images: ghcr.io/${{ github.repository_owner }}/${{ matrix.target }}
|
|
tags: |
|
|
type=edge,branch=main
|
|
type=sha,branch=main
|
|
type=semver,pattern={{version}}
|
|
|
|
- name: Create manifest list and push
|
|
working-directory: ${{ runner.temp }}/digests
|
|
run: |
|
|
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
|
|
$(printf 'ghcr.io/${{ github.repository_owner }}/${{ matrix.target }}@sha256:%s ' *)
|
|
|
|
- name: Inspect image
|
|
run: |
|
|
docker buildx imagetools inspect ghcr.io/${{ github.repository_owner }}/${{ matrix.target }}:${{ steps.meta.outputs.version }}
|