236 lines
8.1 KiB
YAML
236 lines
8.1 KiB
YAML
name: Build and test image
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- master
|
|
tags:
|
|
- 'v[0-9]+.[0-9]+.[0-9]+'
|
|
pull_request:
|
|
branches:
|
|
- master
|
|
|
|
# cancel outdated jobs for the same reference
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
IMAGE : ${{ github.repository_owner }}/openstreetmap-tile-server
|
|
TAG : ${{ github.sha }}
|
|
# Use docker.io for Docker Hub if empty
|
|
REGISTRY: ghcr.io
|
|
# github.repository as <account>/<repo>
|
|
IMAGE_NAME: ${{ github.repository }}
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
|
|
build:
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- arch : amd64
|
|
mode : build-and-test
|
|
- arch : arm64
|
|
variant : v8
|
|
mode : build-only
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
VOLUME : osm-db
|
|
CONTAINER : osm-www
|
|
MOUNT : /data/database/
|
|
PLATFORM : linux/${{ matrix.arch }}${{ (matrix.variant != '' && format('/{0}', matrix.variant)) || '' }}
|
|
steps:
|
|
-
|
|
name: Harden the runner (Audit all outbound calls)
|
|
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
|
|
|
-
|
|
name: Set up QEMU
|
|
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
|
|
with:
|
|
platforms: ${{ matrix.arch }}
|
|
-
|
|
name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
|
|
-
|
|
name: Environment
|
|
run : |
|
|
echo IMAGE=$(echo ${{ env.IMAGE }} | tr '[:upper:]' '[:lower:]') >>$GITHUB_ENV
|
|
-
|
|
name: Docker build
|
|
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
|
|
with:
|
|
pull : true
|
|
load : ${{ matrix.mode == 'build-and-test' }}
|
|
platforms : ${{ env.PLATFORM }}
|
|
context : .
|
|
file : ./Dockerfile
|
|
tags : ${{ env.IMAGE }}:${{ env.TAG }}
|
|
cache-from : type=gha,scope=${{ github.workflow }}:${{ env.PLATFORM }}
|
|
cache-to : type=gha,scope=${{ github.workflow }}:${{ env.PLATFORM }},mode=max
|
|
-
|
|
name: Import Luxembourg
|
|
if : ${{ matrix.mode == 'build-and-test' }}
|
|
run : |
|
|
docker volume create ${VOLUME}
|
|
docker run --rm --shm-size=128M -v ${VOLUME}:${MOUNT} -e UPDATES=enabled ${IMAGE}:${TAG} import
|
|
-
|
|
name: Start server
|
|
if : ${{ matrix.mode == 'build-and-test' }}
|
|
run : |
|
|
docker run --shm-size=128M -v ${VOLUME}:${MOUNT} -e UPDATES=enabled -p 80:80 -d --name ${CONTAINER} ${IMAGE}:${TAG} run
|
|
sleep 30
|
|
docker logs ${CONTAINER}
|
|
-
|
|
name: Download tiles
|
|
if : ${{ matrix.mode == 'build-and-test' }}
|
|
run : |
|
|
curl http://localhost/tile/0/0/0.png --fail -o 000.png
|
|
curl http://localhost/tile/1/0/0.png --fail -o 100.png
|
|
curl http://localhost/tile/1/0/1.png --fail -o 101.png
|
|
curl http://localhost/tile/1/1/0.png --fail -o 110.png
|
|
curl http://localhost/tile/1/1/1.png --fail -o 111.png
|
|
curl http://localhost/tile/18/138474/85459.png --fail -o empty.png
|
|
curl http://localhost/tile/18/135536/89345.png --fail -o example.png
|
|
-
|
|
name: Upload tiles
|
|
if : ${{ matrix.mode == 'build-and-test' }}
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
|
with:
|
|
name: tiles
|
|
path: '*.png'
|
|
-
|
|
name: Verify tiles
|
|
if : ${{ matrix.mode == 'build-and-test' }}
|
|
run : |
|
|
sha1sum *.png
|
|
sha1sum --check <<EOF
|
|
c226ca747874fb1307eef853feaf9d8db28cef2b *empty.png
|
|
EOF
|
|
tiles=(`ls *.png`)
|
|
for ((i=0; i<${#tiles[@]}; i++)) ; do
|
|
if [ `file --brief --mime-type "${tiles[$i]}"` != 'image/png' ] ; then
|
|
>&2 echo "ERROR: ${tiles[$i]} is not a image/png file"
|
|
exit 1
|
|
fi
|
|
for ((j=i+1; j<${#tiles[@]}; j++)) ; do
|
|
if ( diff "${tiles[$i]}" "${tiles[$j]}" ) ; then
|
|
>&2 echo "ERROR: ${tiles[$i]} is identical to ${tiles[$j]}"
|
|
exit 2
|
|
fi
|
|
done
|
|
done
|
|
-
|
|
name: Cleanup
|
|
if : ${{ matrix.mode == 'build-and-test' }}
|
|
run : |
|
|
docker rm --force --volumes ${CONTAINER}
|
|
docker volume rm --force ${VOLUME}
|
|
docker rmi --force ${IMAGE}:${TAG}
|
|
|
|
deploy:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
# This is used to complete the identity challenge
|
|
# with sigstore/fulcio when running outside of PRs.
|
|
id-token: write
|
|
attestations: write
|
|
needs:
|
|
- build
|
|
if: ${{ github.event_name != 'pull_request' }}
|
|
steps:
|
|
- name: Harden the runner (Audit all outbound calls)
|
|
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
|
|
|
# Install the cosign tool except on PR
|
|
# https://github.com/sigstore/cosign-installer
|
|
-
|
|
name: Install cosign
|
|
if: github.event_name != 'pull_request'
|
|
uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 #v3.9.2
|
|
|
|
-
|
|
name: Set up QEMU
|
|
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
|
|
with:
|
|
platforms: amd64,arm64
|
|
|
|
-
|
|
name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
|
|
|
|
-
|
|
name: Login to GHCR
|
|
if: github.event_name != 'pull_request'
|
|
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
# Extract metadata (tags, labels) for Docker
|
|
# https://github.com/docker/metadata-action
|
|
- name: Extract Docker metadata
|
|
id: meta
|
|
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
|
|
with:
|
|
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
|
-
|
|
name: Build and push
|
|
id: build-and-push
|
|
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
|
|
with:
|
|
sbom : true
|
|
pull : true
|
|
push : true
|
|
platforms : linux/amd64,linux/arm64/v8
|
|
context : .
|
|
file : ./Dockerfile
|
|
tags : ${{ steps.meta.outputs.tags }}
|
|
labels : ${{ steps.meta.outputs.labels }}
|
|
cache-from: |
|
|
type=gha,scope=${{ github.workflow }}:linux/amd64
|
|
type=gha,scope=${{ github.workflow }}:linux/arm64/v8
|
|
cache-to: type=gha,mode=max
|
|
|
|
# Sign the resulting Docker image digest except on PRs.
|
|
# This will only write to the public Rekor transparency log when the Docker
|
|
# repository is public to avoid leaking data. If you would like to publish
|
|
# transparency data even for private images, pass --force to cosign below.
|
|
# https://github.com/sigstore/cosign
|
|
- name: Sign the published Docker image
|
|
if: ${{ github.event_name != 'pull_request' }}
|
|
env:
|
|
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
|
|
TAGS: ${{ steps.meta.outputs.tags }}
|
|
DIGEST: ${{ steps.build-and-push.outputs.digest }}
|
|
# This step uses the identity token to provision an ephemeral certificate
|
|
# against the sigstore community Fulcio instance.
|
|
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
|
|
|
|
- name: Attest
|
|
if: github.event_name != 'pull_request'
|
|
uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
|
|
id: attest
|
|
with:
|
|
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
|
subject-digest: ${{ steps.build-and-push.outputs.digest }}
|
|
push-to-registry: true |