Skip to content

Commit 5abd0b3

Browse files
sebthomsebthom
committed
build: improve build config
1 parent 96c8f10 commit 5abd0b3

12 files changed

Lines changed: 466 additions & 248 deletions

File tree

‎.gitattributes‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,8 @@
6060
*.php text
6161
*.python text
6262
*.sql text
63+
**/Dockerfile text eol=lf
64+
**/*.Dockerfile text eol=lf
6365

6466

6567
# Archives

‎.github/dependabot.yml‎

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,17 @@
1-
# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
1+
# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
22
version: 2
33
updates:
4-
- package-ecosystem: github-actions
5-
directory: /
6-
schedule:
7-
interval: weekly
8-
day: monday
9-
time: "09:00"
10-
commit-message:
11-
prefix: fix
12-
prefix-development: chore
13-
include: scope
14-
labels:
15-
- gha
16-
- dependencies
4+
- package-ecosystem: github-actions
5+
directory: /
6+
schedule:
7+
interval: weekly
8+
day: monday
9+
time: "14:00"
10+
commit-message:
11+
prefix: ci
12+
prefix-development: ci
13+
include: scope
14+
labels:
15+
- dependencies
16+
- gha
17+
- pinned

‎.github/stale.yml‎

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎.github/workflows/build.yml‎

Lines changed: 109 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,42 +1,101 @@
1-
# Copyright 2021 by Vegard IT GmbH, Germany, https://vegardit.com
1+
# SPDX-FileCopyrightText: © Vegard IT GmbH (https://vegardit.com)
2+
# SPDX-FileContributor: Sebastian Thomschke
23
# SPDX-License-Identifier: Apache-2.0
4+
# SPDX-ArtifactOfProjectHomePage: https://github.com/vegardit/docker-softhsm2-pkcs11-proxy
35
#
4-
# Author: Sebastian Thomschke, Vegard IT GmbH
5-
#
6-
# https://github.com/vegardit/docker-softhsm2-pkcs11-proxy
7-
#
8-
# https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions
6+
# https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions
97
name: Build
108

119
on:
1210
push:
13-
branches:
14-
- '**'
15-
tags-ignore:
11+
branches-ignore: # build all branches except:
12+
- 'dependabot/**' # prevent GHA triggered twice (once for commit to the branch and once for opening/syncing the PR)
13+
tags-ignore: # don't build tags
1614
- '**'
1715
paths-ignore:
1816
- '**/*.md'
17+
- '.editorconfig'
18+
- '.git*'
19+
- '.github/*.yml'
20+
- '.github/workflows/stale.yml'
21+
pull_request:
22+
paths-ignore:
23+
- '**/*.md'
24+
- '.editorconfig'
25+
- '.git*'
26+
- '.github/*.yml'
27+
- '.github/workflows/stale.yml'
1928
schedule:
20-
# https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows
21-
- cron: '0 0 * * *'
29+
# https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows
30+
- cron: '0 17 * * 3'
2231
workflow_dispatch:
23-
# https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/
32+
# https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#workflow_dispatch
33+
34+
defaults:
35+
run:
36+
shell: bash
2437

2538
env:
39+
DOCKER_IMAGE_REPO: ${{ github.repository_owner }}/softhsm2-pkcs11-proxy
2640
TRIVY_CACHE_DIR: ~/.trivy/cache
2741

2842
jobs:
43+
44+
###########################################################
2945
build:
30-
runs-on: ubuntu-latest
46+
###########################################################
47+
runs-on: ubuntu-latest # https://github.com/actions/runner-images#available-images
48+
timeout-minutes: 60
49+
50+
permissions:
51+
packages: write
3152

3253
strategy:
3354
matrix:
34-
DOCKER_BASE_IMAGE: [ "alpine:latest", "debian:stable-slim" ]
3555
SOFTHSM_VERSION: [ "latest", "develop" ]
56+
DOCKER_BASE_IMAGE:
57+
- ghcr.io/dockerhub-mirror/alpine:latest
58+
- ghcr.io/dockerhub-mirror/debian:stable-slim
3659

3760
steps:
61+
- name: "Show: GitHub context"
62+
env:
63+
GITHUB_CONTEXT: ${{ toJSON(github) }}
64+
run: echo $GITHUB_CONTEXT
65+
66+
67+
- name: "Show: environment variables"
68+
run: env | sort
69+
70+
3871
- name: Git Checkout
39-
uses: actions/checkout@v4 #https://github.com/actions/checkout
72+
uses: actions/checkout@v4 # https://github.com/actions/checkout
73+
74+
75+
- name: Run the sh-checker
76+
uses: luizm/action-sh-checker@master # https://github.com/marketplace/actions/sh-checker
77+
env:
78+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
79+
SHFMT_OPTS: --simplify --keep-padding
80+
with:
81+
sh_checker_comment: true
82+
sh_checker_checkbashisms_enable: true
83+
sh_checker_shfmt_disable: true
84+
85+
86+
- name: Check Alpine Dockerfile
87+
uses: hadolint/hadolint-action@v3.1.0
88+
if: ${{ startsWith(matrix.DOCKER_BASE_IMAGE, 'alpine') }}
89+
with:
90+
dockerfile: image/alpine.Dockerfile
91+
92+
93+
- name: Check Debian Dockerfile
94+
uses: hadolint/hadolint-action@v3.1.0
95+
if: ${{ startsWith(matrix.DOCKER_BASE_IMAGE, 'debian') }}
96+
with:
97+
dockerfile: image/debian.Dockerfile
98+
4099

41100
- name: Cache trivy cache
42101
uses: actions/cache@v4
@@ -47,24 +106,47 @@ jobs:
47106
restore-keys: |
48107
${{ runner.os }}-trivy-
49108
109+
50110
- name: Configure fast APT repository mirror
51111
uses: vegardit/fast-apt-mirror.sh@v1
52112

113+
53114
- name: Install dos2unix
54115
run: sudo apt-get install --no-install-recommends -y dos2unix
55116

56-
- name: Build docker image
57-
shell: bash
117+
118+
- name: "Determine if docker images shall be published"
119+
run: |
120+
# ACT -> https://nektosact.com/usage/index.html#skipping-steps
121+
set -x
122+
if [[ $GITHUB_REF_NAME == 'main' && $GITHUB_EVENT_NAME != 'pull_request' && -z "$ACT" ]]; then
123+
echo "DOCKER_PUSH_GHCR=true" >> "$GITHUB_ENV"
124+
if [[ -n "${{ secrets.DOCKER_HUB_USERNAME }}" ]]; then
125+
echo "DOCKER_PUSH=true" >> "$GITHUB_ENV"
126+
fi
127+
fi
128+
129+
130+
- name: Login to docker.io
131+
if: ${{ env.DOCKER_PUSH }}
132+
uses: docker/login-action@v3
133+
with:
134+
username: ${{ secrets.DOCKER_HUB_USERNAME }}
135+
password: ${{ secrets.DOCKER_HUB_TOKEN }}
136+
137+
138+
- name: Login to ghcr.io
139+
if: ${{ env.DOCKER_PUSH_GHCR }}
140+
uses: docker/login-action@v3
141+
with:
142+
registry: ghcr.io
143+
username: ${{ github.actor }}
144+
password: ${{ secrets.GITHUB_TOKEN }}
145+
146+
147+
- name: Build ${{ env.DOCKER_IMAGE_REPO }}:${{ matrix.SOFTHSM_VERSION }}
58148
env:
59149
DOCKER_BASE_IMAGE: ${{ matrix.DOCKER_BASE_IMAGE }}
60-
DOCKER_REGISTRY: docker.io
61-
DOCKER_REGISTRY_USERNAME: ${{ secrets.DOCKER_HUB_USERNAME }}
62-
DOCKER_REGISTRY_TOKEN: ${{ secrets.DOCKER_HUB_TOKEN }}
63150
SOFTHSM_VERSION: ${{ matrix.SOFTHSM_VERSION }}
64-
TRIVY_GITHUB_TOKEN: ${{ github.token }}
65-
run: |
66-
if [[ $GITHUB_REF_NAME == "main" && $ACT != "true" ]]; then
67-
export DOCKER_PUSH=1
68-
echo "$DOCKER_REGISTRY_TOKEN" | docker login -u="$DOCKER_REGISTRY_USERNAME" "$DOCKER_REGISTRY" --password-stdin
69-
fi
70-
bash build-image.sh
151+
TRIVY_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
152+
run: bash build-image.sh

‎.github/workflows/stale.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions
2+
name: Stale issues
3+
4+
on:
5+
schedule:
6+
- cron: '0 16 * * 1'
7+
workflow_dispatch:
8+
# https://github.blog/changelog/2020-07-06-github-actions-manual-triggers-with-workflow_dispatch/
9+
10+
permissions:
11+
issues: write
12+
pull-requests: write
13+
14+
jobs:
15+
stale:
16+
runs-on: ubuntu-latest
17+
18+
steps:
19+
- name: Git checkout
20+
uses: actions/checkout@v4 # https://github.com/actions/checkout
21+
22+
- name: Run stale action
23+
uses: actions/stale@v9 # https://github.com/actions/stale
24+
with:
25+
repo-token: ${{ secrets.GITHUB_TOKEN }}
26+
days-before-stale: 90
27+
days-before-close: 14
28+
stale-issue-message: >
29+
This issue has been automatically marked as stale because it has not had
30+
recent activity. It will be closed in 14 days if no further activity occurs.
31+
If the issue is still valid, please add a respective comment to prevent this
32+
issue from being closed automatically. Thank you for your contributions.
33+
stale-issue-label: stale
34+
close-issue-label: wontfix
35+
exempt-issue-labels: |
36+
enhancement
37+
pinned
38+
security
39+
40+
- name: Run stale action (for enhancements)
41+
uses: actions/stale@v9 # https://github.com/actions/stale
42+
with:
43+
repo-token: ${{ secrets.GITHUB_TOKEN }}
44+
days-before-stale: 360
45+
days-before-close: 14
46+
stale-issue-message: >
47+
This issue has been automatically marked as stale because it has not had
48+
recent activity. It will be closed in 14 days if no further activity occurs.
49+
If the issue is still valid, please add a respective comment to prevent this
50+
issue from being closed automatically. Thank you for your contributions.
51+
stale-issue-label: stale
52+
close-issue-label: wontfix
53+
only-labels: enhancement
54+
exempt-issue-labels: |
55+
pinned
56+
security

‎.gitignore‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,16 +14,16 @@ bin/
1414
**/.*.md.html
1515

1616
# IntelliJ
17-
.idea
18-
*.iml
19-
*.ipr
20-
*.iws
17+
/.idea
18+
/*.iml
19+
/*.ipr
20+
/*.iws
2121

2222
# NetBeans
2323
nb-configuration.xml
2424

2525
# Visual Studio Code
26-
.vscode
26+
/.vscode
2727

2828
# OSX
2929
.DS_Store

‎README.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,14 @@ Client applications can communicate with the HSM via TCP/TLS using libpkcs11-pro
2626

2727
## <a name="tags"></a>Docker image tagging scheme
2828

29-
|Tag|Description|OS
29+
|Tag|Description|Base Image
3030
|-|-|-
31-
|`:latest` <br> `:latest-alpine` | build of the latest available release | Alpine Latest
32-
|`:latest-debian` | build of the latest available release | Debian Stable
33-
|`:develop` <br> `:develop-alpine` | daily build of the development branch | Alpine Latest
34-
|`:develop-debian` | build of the development branch | Debian Stable
35-
|`:2.x` <br> `:2.x-alpine` | build of the latest minor version of the respective <br> major release, e.g. `2.x` may contain release `2.1` | Alpine Latest
36-
|`:2.x-debian` | build of the latest minor version of the respective <br> major release, e.g. `2.x` may contain release `2.1` | Debian Stable
31+
|`:latest` <br> `:latest-alpine` | weekly build of the latest available SoftHSM release | alpine:latest
32+
|`:latest-debian` | weekly build of the latest available SoftHSM release | debian:stable-slim
33+
|`:develop` <br> `:develop-alpine` | weekly build of the development branch | alpine:latest
34+
|`:develop-debian` | weekly build of the development branch | debian:stable-slim
35+
|`:2.x` <br> `:2.x-alpine` | weekly build of the latest minor version of the respective <br> major release, e.g. `2.x` may contain release `2.6` | alpine:latest
36+
|`:2.x-debian` | weekly build of the latest minor version of the respective <br> major release, e.g. `2.x` may contain release `2.6` | debian:stable-slim
3737

3838
See all tags at https://hub.docker.com/r/vegardit/softhsm2-pkcs11-proxy/tags
3939

0 commit comments

Comments
 (0)