Repository navigation
Feat/ironbank mr workflow (#736) #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Mainline | |
| # Tracks every push to the default branch: builds and pushes a bleeding-edge | |
| # multi-arch image tagged mitre/vulcan:<git-sha> and :latest, then opens an Iron | |
| # Bank merge request against the vulcan-mainline repo1 project. Mirrors | |
| # release.yml, which publishes the stable mitre/vulcan:<version> + :release-latest. | |
| on: | |
| push: | |
| branches: [master] | |
| paths-ignore: | |
| - 'docs/**' | |
| - '*.md' | |
| - 'LICENSE' | |
| - '.github/workflows/ci.yml' | |
| - '.github/workflows/docs.yml' | |
| - '.github/workflows/release.yml' | |
| - '.github/workflows/dependabot.yml' | |
| workflow_dispatch: | |
| inputs: | |
| use_build_cloud: | |
| description: 'Use Docker Build Cloud (fast, but consumes paid build minutes)' | |
| required: false | |
| type: boolean | |
| default: false | |
| concurrency: | |
| group: mainline-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # ─── DOCKER MAINLINE (multi-arch; QEMU by default, Build Cloud opt-in) ─── | |
| docker-mainline: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 20 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Login to DockerHub | |
| uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 | |
| with: | |
| username: ${{ vars.DOCKER_USER }} | |
| password: ${{ secrets.DOCKER_PAT }} | |
| # Default: free QEMU-emulated multi-arch build on the runner. | |
| # Opt into Docker Build Cloud (faster, consumes minutes) via the | |
| # workflow_dispatch `use_build_cloud` input. | |
| - name: Set up QEMU (for emulated multi-arch builds) | |
| if: github.event.inputs.use_build_cloud != 'true' | |
| uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0 | |
| - name: Set up Docker Buildx (local + QEMU emulation) | |
| if: github.event.inputs.use_build_cloud != 'true' | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 | |
| - name: Set up Docker Buildx (Docker Build Cloud) | |
| if: github.event.inputs.use_build_cloud == 'true' | |
| uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 | |
| with: | |
| driver: cloud | |
| endpoint: "mitre/mitre-builder" | |
| - name: Build and push multi-arch image (tags <git-sha> + latest) | |
| uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0 | |
| env: | |
| TAG_SUFFIXES: "${{ github.sha }},latest" | |
| with: | |
| files: docker-bake.hcl | |
| targets: registry | |
| push: true | |
| # ─── IRON BANK MAINLINE STEPS ─── | |
| # Vulcan on IB has both arm and amd builds; we need hashes of both to provide to the hardening manifest in repo1 | |
| - name: Resolve per-architecture image digests for the Iron Bank manifest | |
| id: digests | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| tag="mitre/vulcan:${{ github.sha }}" | |
| amd64="$(docker buildx imagetools inspect "$tag" --format '{{range .Manifest.Manifests}}{{if and (eq .Platform.OS "linux") (eq .Platform.Architecture "amd64")}}{{.Digest}}{{end}}{{end}}')" | |
| arm64="$(docker buildx imagetools inspect "$tag" --format '{{range .Manifest.Manifests}}{{if and (eq .Platform.OS "linux") (eq .Platform.Architecture "arm64")}}{{.Digest}}{{end}}{{end}}')" | |
| [[ "$amd64" == sha256:* ]] || { echo "Failed to resolve amd64 digest for $tag"; exit 1; } | |
| [[ "$arm64" == sha256:* ]] || { echo "Failed to resolve arm64 digest for $tag"; exit 1; } | |
| echo "amd64=$amd64" >> "$GITHUB_OUTPUT" | |
| echo "arm64=$arm64" >> "$GITHUB_OUTPUT" | |
| echo "Resolved digests: amd64=$amd64 arm64=$arm64" | |
| # Opens a MR on Vulcan's vulcan-mainline repo1 repository with the latest main build | |
| - name: Open Iron Bank mainline merge request | |
| uses: mitre/ironbank_release_action@1c14c27db1c37e894f8042ac2edcde08d445882d # v1 | |
| with: | |
| name: Vulcan | |
| version: ${{ github.sha }} | |
| ironbank_pat: ${{ secrets.SAF_IRONBANK_REPO1_PAT }} | |
| ironbank_username: ${{ secrets.SAF_IRONBANK_REPO1_USERNAME }} | |
| ironbank_project_id: 19019 | |
| ironbank_project_clone_url: repo1.dso.mil/dsop/mitre/security-automation-framework/vulcan-mainline.git | |
| git_commit_author_name: "Automated Vulcan Mainline" | |
| git_commit_author_email: "saf@mitre.org" | |
| update_commands: | | |
| yq e -i '.tags[0]=\"${{ github.sha }}\" | .labels.\"org.opencontainers.image.version\"=\"${{ github.sha }}\" | .resources[0].tag=\"mitre/vulcan:${{ github.sha }}\" | .resources[0].url=\"docker://docker.io/mitre/vulcan@${{ steps.digests.outputs.amd64 }}\" | .resources[1].tag=\"mitre/vulcan:${{ github.sha }}.arm64\" | .resources[1].url=\"docker://docker.io/mitre/vulcan@${{ steps.digests.outputs.arm64 }}\"' hardening_manifest.yaml |