wip: slsa 3

Signed-off-by: José Guilherme Vanz <[email protected]>
jvanz · Oct 7, 2024 · 73caa0f · 73caa0f
1 parent e7ca8f9
commit 73caa0f
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 54 deletions.
diff --git a/.github/workflows/container-image.yml b/.github/workflows/container-image.yml
@@ -8,47 +8,18 @@ on:
         value: ${{ jobs.build.outputs.digest }}
 
 jobs:
-  cross-build:
-    name: Cross compile policy-server binary
-    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        targetarch:
-          - aarch64
-          - x86_64
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
-
-      - name: Setup rust toolchain
-        uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
-        with:
-          toolchain: stable
-          target: ${{matrix.targetarch}}-unknown-linux-musl
-          override: true
-
-      - uses: actions-rs/cargo@844f36862e911db73fe0815f00a4a2602c279505 # v1.0.3
-        with:
-          use-cross: true
-          command: build
-          args: --release --target ${{matrix.targetarch}}-unknown-linux-musl
-
-      - name: Upload policy-server binary
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
-        with:
-          name: policy-server-${{ matrix.targetarch }}
-          path: |
-            target/${{ matrix.targetarch }}-unknown-linux-musl/release/policy-server
-
   build:
     name: Build container image
     permissions:
       packages: write
-    needs:
-      - cross-build
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        targetarch:
+          # - aarch64
+          # - x86_64
+          - linux/amd64
+          - linux/arm64
     outputs:
       repository: ${{ steps.setoutput.outputs.repository }}
       tag: ${{ steps.setoutput.outputs.tag }}
@@ -57,55 +28,47 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+
       - name: Set up QEMU
         uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
+
       - name: Login to GitHub Container Registry
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      # Download the policy-server artifacts we've built inside of the previous job
-      - name: Download policy-server-x86_64 artifact
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
-        with:
-          name: policy-server-x86_64
-          path: artifacts-x86_64
-      - name: Download policy-server-aarch64 artifact
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
-        with:
-          name: policy-server-aarch64
-          path: artifacts-aarch64
-      - name: Move binaries to project root
-        run: |
-          mv artifacts-x86_64/policy-server policy-server-x86_64
-          mv artifacts-aarch64/policy-server policy-server-aarch64
-
       - name: Retrieve tag name (main branch)
         if: ${{ startsWith(github.ref, 'refs/heads/main') }}
         run: |
           echo TAG_NAME=latest >> $GITHUB_ENV
+
       - name: Retrieve tag name (feat branch)
         if: ${{ startsWith(github.ref, 'refs/heads/feat') }}
         run: |
           echo "TAG_NAME=latest-$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_ENV
+          
       - name: Retrieve tag name (tag)
         if: ${{ startsWith(github.ref, 'refs/tags/') }}
         run: |
           echo TAG_NAME=$(echo $GITHUB_REF | sed -e "s|refs/tags/||") >> $GITHUB_ENV
+
       - name: Push and push container image
         id: build-image
         uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
         with:
           context: .
-          file: ./Dockerfile.github
-          platforms: linux/amd64, linux/arm64
+          file: ./Dockerfile
+          # platforms: linux/amd64, linux/arm64
+          platforms: ${{matrix.targetarch}} 
           push: true
           tags: |
             ghcr.io/${{github.repository_owner}}/policy-server:${{ env.TAG_NAME }}
+
       - id: setoutput
         name: Set output parameters
         run: |

diff --git a/Dockerfile b/Dockerfile
@@ -6,6 +6,9 @@ RUN apk add --no-cache musl-dev make
 RUN mkdir /usr/src/policy-server
 WORKDIR /usr/src/policy-server
 COPY ./ ./
+RUN rustup toolchain install stable-$(arch)-unknown-linux-musl
+RUN rustup target add  --toolchain stable $(arch)-unknown-linux-musl
+# RUN cargo build --release --target $(arch)-unknown-linux-musl
 RUN cargo install --target $(arch)-unknown-linux-musl --path .
 
 FROM alpine AS cfg