fix: bulk-read OD run summaries #856
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Sign Container Image | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ['v*'] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| REGISTRY: docker.io | |
| IMAGE_NAME: dockerdigitalarsenal/space-data-network | |
| permissions: | |
| contents: read | |
| id-token: write | |
| jobs: | |
| build-and-sign: | |
| name: Build and Sign Image | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '24' | |
| cache: 'npm' | |
| cache-dependency-path: | | |
| sdn-js/package-lock.json | |
| webui/package-lock.json | |
| - name: Build shared admin shell assets | |
| working-directory: sdn-js | |
| run: | | |
| npm ci | |
| npm run build:ui | |
| - name: Build IPFS WebUI assets | |
| working-directory: webui | |
| run: | | |
| npm ci | |
| npm run build | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@v3.4.0 | |
| with: | |
| cosign-release: 'v2.2.3' | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Log in to Docker Hub | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: dockerdigitalarsenal | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Extract Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=ref,event=branch | |
| type=ref,event=pr | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=sha,prefix= | |
| - name: Build and push Docker image | |
| id: build-and-push | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| file: deployment/docker/Dockerfile | |
| push: ${{ github.event_name != 'pull_request' }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| provenance: true | |
| sbom: true | |
| - name: Sign container image | |
| if: github.event_name != 'pull_request' | |
| env: | |
| DIGEST: ${{ steps.build-and-push.outputs.digest }} | |
| TAGS: ${{ steps.meta.outputs.tags }} | |
| run: | | |
| images="" | |
| for tag in ${TAGS}; do | |
| images+="${tag}@${DIGEST} " | |
| done | |
| cosign sign --yes ${images} | |
| - name: Attest SBOM | |
| if: github.event_name != 'pull_request' | |
| env: | |
| DIGEST: ${{ steps.build-and-push.outputs.digest }} | |
| run: | | |
| IMAGE="${IMAGE_NAME}@${DIGEST}" | |
| docker run --rm anchore/syft:latest packages "${IMAGE}" -o cyclonedx-json > sbom.json || true | |
| if [ -f sbom.json ] && [ -s sbom.json ]; then | |
| cosign attest --yes --predicate sbom.json --type cyclonedx "${IMAGE}" | |
| else | |
| echo "::warning::SBOM generation skipped or failed" | |
| fi | |
| - name: Output verification instructions | |
| if: github.event_name != 'pull_request' | |
| run: | | |
| echo "=== Verification Instructions ===" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "To verify the image signature:" >> "$GITHUB_STEP_SUMMARY" | |
| echo '```bash' >> "$GITHUB_STEP_SUMMARY" | |
| echo "cosign verify ${IMAGE_NAME}:${{ github.ref_name }} \\" >> "$GITHUB_STEP_SUMMARY" | |
| echo " --certificate-identity-regexp='https://github.com/${{ github.repository }}/.*' \\" >> "$GITHUB_STEP_SUMMARY" | |
| echo " --certificate-oidc-issuer='https://token.actions.githubusercontent.com'" >> "$GITHUB_STEP_SUMMARY" | |
| echo '```' >> "$GITHUB_STEP_SUMMARY" | |
| verify-signature: | |
| name: Verify Image Signature | |
| runs-on: ubuntu-latest | |
| needs: build-and-sign | |
| if: github.event_name != 'pull_request' | |
| steps: | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@v3.4.0 | |
| - name: Verify image | |
| run: | | |
| cosign verify ${{ env.IMAGE_NAME }}:${{ github.ref_name }} \ | |
| --certificate-identity-regexp='https://github.com/${{ github.repository }}/.*' \ | |
| --certificate-oidc-issuer='https://token.actions.githubusercontent.com' | |
| - name: Summary | |
| run: | | |
| echo "# Container Image Signing Summary" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| Image | Tag | Signed |" >> "$GITHUB_STEP_SUMMARY" | |
| echo "|-------|-----|--------|" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| ${{ env.IMAGE_NAME }} | ${{ github.ref_name }} | yes |" >> "$GITHUB_STEP_SUMMARY" |