Skip to content

Commit 7920217

Browse files
danbarrdanbarr
authored
Handle mixed case names in build-image workflows (#33)
The container build workflows fail if the GitHub organization name or repository name use mixed case, since Docker only supports lower-cased image names. Updated workflows to use the docker/metadata-action tags output since that action handles the normalization, and added normalization to the Makefile.
1 parent c2bb970 commit 7920217

11 files changed

+95
-42
lines changed

‎.github/workflows/build-image-signed-cosign-malicious.yml

+6-5
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ env:
88

99
jobs:
1010
build:
11-
1211
runs-on: ubuntu-latest
1312
permissions:
1413
contents: read
@@ -41,23 +40,25 @@ jobs:
4140
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
4241
with:
4342
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
43+
tags: |
44+
type=raw,value=latest
45+
type=raw,value=daily
4446
4547
- name: Build and push Docker image
4648
id: build-and-push
4749
uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
4850
with:
4951
context: .
5052
push: ${{ github.event_name != 'pull_request' }}
51-
tags: ghcr.io/${{ github.repository }}:latest,ghcr.io/${{ github.repository }}:daily
53+
tags: ${{ steps.meta.outputs.tags }}
5254
labels: ${{ steps.meta.outputs.labels }}
5355
cache-from: type=gha
5456
cache-to: type=gha,mode=max
5557

56-
5758
- name: Sign the published Docker image
5859
env:
60+
TAGS: ${{ steps.meta.outputs.tags }}
5961
DIGEST: ${{ steps.build-and-push.outputs.digest }}
6062
run: |
6163
cosign version
62-
echo "ghcr.io/${{ github.repository }}:daily" | xargs -I {} cosign sign --yes {}@${DIGEST}
63-
echo "ghcr.io/${{ github.repository }}:latest" | xargs -I {} cosign sign --yes {}@${DIGEST}
64+
echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎.github/workflows/build-image-signed-cosign-static-copied.yml

+6-5
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ env:
88

99
jobs:
1010
build:
11-
1211
runs-on: ubuntu-latest
1312
permissions:
1413
contents: read
@@ -37,20 +36,22 @@ jobs:
3736
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
3837
with:
3938
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
39+
tags: |
40+
type=raw,value=static
4041
4142
- name: Build and push Docker image
4243
id: build-and-push
4344
uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
4445
with:
4546
push: true
46-
tags: ghcr.io/${{ github.repository }}:static
47+
tags: ${{ steps.meta.outputs.tags }}
4748
context: .
48-
file : Dockerfile.static
49-
49+
file: Dockerfile.static
5050

5151
- name: Sign the published Docker image
5252
env:
53+
TAGS: ${{ steps.meta.outputs.tags }}
5354
DIGEST: ${{ steps.build-and-push.outputs.digest }}
5455
run: |
5556
cosign version
56-
echo "ghcr.io/${{ github.repository }}:static" | xargs -I {} cosign sign --yes {}@${DIGEST}
57+
echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎.github/workflows/build-image-signed-cosign-static.yml

+6-5
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ env:
88

99
jobs:
1010
build:
11-
1211
runs-on: ubuntu-latest
1312
permissions:
1413
contents: read
@@ -37,20 +36,22 @@ jobs:
3736
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
3837
with:
3938
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
39+
tags: |
40+
type=raw,value=static
4041
4142
- name: Build and push Docker image
4243
id: build-and-push
4344
uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
4445
with:
4546
push: true
46-
tags: ghcr.io/${{ github.repository }}:static
47+
tags: ${{ steps.meta.outputs.tags }}
4748
context: .
48-
file : Dockerfile.static
49-
49+
file: Dockerfile.static
5050

5151
- name: Sign the published Docker image
5252
env:
53+
TAGS: ${{ steps.meta.outputs.tags }}
5354
DIGEST: ${{ steps.build-and-push.outputs.digest }}
5455
run: |
5556
cosign version
56-
echo "ghcr.io/${{ github.repository }}:static" | xargs -I {} cosign sign --yes {}@${DIGEST}
57+
echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎.github/workflows/build-image-signed-cosign.yml

+6-5
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ env:
88

99
jobs:
1010
build:
11-
1211
runs-on: ubuntu-latest
1312
permissions:
1413
contents: read
@@ -37,23 +36,25 @@ jobs:
3736
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
3837
with:
3938
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
39+
tags: |
40+
type=raw,value=latest
41+
type=raw,value=daily
4042
4143
- name: Build and push Docker image
4244
id: build-and-push
4345
uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
4446
with:
4547
context: .
4648
push: ${{ github.event_name != 'pull_request' }}
47-
tags: ghcr.io/${{ github.repository }}:latest,ghcr.io/${{ github.repository }}:daily
49+
tags: ${{ steps.meta.outputs.tags }}
4850
labels: ${{ steps.meta.outputs.labels }}
4951
cache-from: type=gha
5052
cache-to: type=gha,mode=max
5153

52-
5354
- name: Sign the published Docker image
5455
env:
56+
TAGS: ${{ steps.meta.outputs.tags }}
5557
DIGEST: ${{ steps.build-and-push.outputs.digest }}
5658
run: |
5759
cosign version
58-
echo "ghcr.io/${{ github.repository }}:daily" | xargs -I {} cosign sign --yes {}@${DIGEST}
59-
echo "ghcr.io/${{ github.repository }}:latest" | xargs -I {} cosign sign --yes {}@${DIGEST}
60+
echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎.github/workflows/build-image-signed-ghat-malicious.yml

+16-1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@ name: image-signed-ghat(latest)-malicious
22
on:
33
workflow_dispatch:
44

5+
env:
6+
REGISTRY: ghcr.io
7+
IMAGE_NAME: ${{ github.repository }}
8+
59
jobs:
610
build:
711
runs-on: ubuntu-latest
@@ -16,6 +20,8 @@ jobs:
1620
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
1721

1822
- name: The malicious step
23+
env:
24+
IMAGE_NAME: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
1925
run: |
2026
make build-malicious-image
2127
@@ -26,16 +32,25 @@ jobs:
2632
username: ${{ github.actor }}
2733
password: ${{ secrets.GITHUB_TOKEN }}
2834

35+
- name: Extract Docker metadata
36+
id: meta
37+
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
38+
with:
39+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
40+
tags: |
41+
type=raw,value=latest
42+
2943
- name: Build and push image
3044
id: push-step
3145
uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
3246
with:
3347
push: true
34-
tags: ghcr.io/${{ github.repository }}:latest
48+
tags: ${{ steps.meta.outputs.tags }}
3549
context: .
3650

3751
- name: Attest image
3852
uses: actions/[email protected]
3953
with:
4054
subject-name: ghcr.io/${{ github.repository }}
4155
subject-digest: ${{ steps.push-step.outputs.digest }}
56+
push-to-registry: true

‎.github/workflows/build-image-signed-ghat-static-copied.yml

+15-2
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@ name: image-signed-ghat(static)-copied
22
on:
33
workflow_dispatch:
44

5+
env:
6+
REGISTRY: ghcr.io
7+
IMAGE_NAME: ${{ github.repository }}
8+
59
jobs:
610
build:
711
runs-on: ubuntu-latest
@@ -22,17 +26,26 @@ jobs:
2226
username: ${{ github.actor }}
2327
password: ${{ secrets.GITHUB_TOKEN }}
2428

29+
- name: Extract Docker metadata
30+
id: meta
31+
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
32+
with:
33+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
34+
tags: |
35+
type=raw,value=static
36+
2537
- name: Build and push image
2638
id: push-step
2739
uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
2840
with:
2941
push: true
30-
tags: ghcr.io/${{ github.repository }}:static
42+
tags: ${{ steps.meta.outputs.tags }}
3143
context: .
32-
file : Dockerfile.static
44+
file: Dockerfile.static
3345

3446
- name: Attest image
3547
uses: actions/[email protected]
3648
with:
3749
subject-name: ghcr.io/${{ github.repository }}
3850
subject-digest: ${{ steps.push-step.outputs.digest }}
51+
push-to-registry: true

‎.github/workflows/build-image-signed-ghat-static.yml

+15-2
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@ name: image-signed-ghat(static)
22
on:
33
workflow_dispatch:
44

5+
env:
6+
REGISTRY: ghcr.io
7+
IMAGE_NAME: ${{ github.repository }}
8+
59
jobs:
610
build:
711
runs-on: ubuntu-latest
@@ -22,17 +26,26 @@ jobs:
2226
username: ${{ github.actor }}
2327
password: ${{ secrets.GITHUB_TOKEN }}
2428

29+
- name: Extract Docker metadata
30+
id: meta
31+
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
32+
with:
33+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
34+
tags: |
35+
type=raw,value=static
36+
2537
- name: Build and push image
2638
id: push-step
2739
uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
2840
with:
2941
push: true
30-
tags: ghcr.io/${{ github.repository }}:static
42+
tags: ${{ steps.meta.outputs.tags }}
3143
context: .
32-
file : Dockerfile.static
44+
file: Dockerfile.static
3345

3446
- name: Attest image
3547
uses: actions/[email protected]
3648
with:
3749
subject-name: ghcr.io/${{ github.repository }}
3850
subject-digest: ${{ steps.push-step.outputs.digest }}
51+
push-to-registry: true

‎.github/workflows/build-image-signed-ghat.yml

+14-1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@ name: image-signed-ghat(latest)
22
on:
33
workflow_dispatch:
44

5+
env:
6+
REGISTRY: ghcr.io
7+
IMAGE_NAME: ${{ github.repository }}
8+
59
jobs:
610
build:
711
runs-on: ubuntu-latest
@@ -22,16 +26,25 @@ jobs:
2226
username: ${{ github.actor }}
2327
password: ${{ secrets.GITHUB_TOKEN }}
2428

29+
- name: Extract Docker metadata
30+
id: meta
31+
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
32+
with:
33+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
34+
tags: |
35+
type=raw,value=latest
36+
2537
- name: Build and push image
2638
id: push-step
2739
uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
2840
with:
2941
push: true
30-
tags: ghcr.io/${{ github.repository }}:latest
42+
tags: ${{ steps.meta.outputs.tags }}
3143
context: .
3244

3345
- name: Attest image
3446
uses: actions/[email protected]
3547
with:
3648
subject-name: ghcr.io/${{ github.repository }}
3749
subject-digest: ${{ steps.push-step.outputs.digest }}
50+
push-to-registry: true

‎.github/workflows/build-image-unsigned.yml

+4-14
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ env:
88

99
jobs:
1010
build:
11-
1211
runs-on: ubuntu-latest
1312
permissions:
1413
contents: read
@@ -19,11 +18,6 @@ jobs:
1918
- name: Checkout repository
2019
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
2120

22-
# - name: Install Cosign
23-
# uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 #v3.1.1
24-
# with:
25-
# cosign-release: 'v2.1.1'
26-
2721
- name: Setup Docker buildx
2822
uses: docker/setup-buildx-action@79abd3f86f79a9d68a23c75a09a9a85889262adf
2923

@@ -39,21 +33,17 @@ jobs:
3933
uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
4034
with:
4135
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
36+
tags: |
37+
type=raw,value=latest
38+
type=raw,value=daily
4239
4340
- name: Build and push Docker image
4441
id: build-and-push
4542
uses: docker/build-push-action@ac9327eae2b366085ac7f6a2d02df8aa8ead720a
4643
with:
4744
context: .
4845
push: ${{ github.event_name != 'pull_request' }}
49-
tags: ghcr.io/${{ github.repository }}:latest,ghcr.io/${{ github.repository }}:daily
46+
tags: ${{ steps.meta.outputs.tags }}
5047
labels: ${{ steps.meta.outputs.labels }}
5148
cache-from: type=gha
5249
cache-to: type=gha,mode=max
53-
54-
# - name: Sign the published Docker image
55-
# env:
56-
# DIGEST: ${{ steps.build-and-push.outputs.digest }}
57-
# run: |
58-
# echo "ghcr.io/${{ github.repository }}:daily" | xargs -I {} cosign sign --yes {}@${DIGEST}
59-
# echo "ghcr.io/${{ github.repository }}:latest" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎Makefile

+3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
# Replace this with your image name, i.e. ghcr.io/<your-username>/demo-repo-go:latest
22
IMAGE_NAME?=ghcr.io/stacklok/demo-repo-go:latest
33

4+
# Lowercase the image name to handle mixed-case GitHub org/repo names
5+
IMAGE_NAME := $(shell echo $(IMAGE_NAME) | tr '[:upper:]' '[:lower:]')
6+
47
# Replace this with your GitHub username and PAT.
58
# This is used to authenticate with GitHub Container Registry (GHCR)
69
# and push the image to your repository.

0 commit comments

Comments
 (0)