From 133991c88d2bdb8f472c5b2afff6c52fedb123c5 Mon Sep 17 00:00:00 2001 From: mr-chelyshkin Date: Tue, 5 Aug 2025 14:44:59 +0300 Subject: [PATCH 1/9] init --- .github/workflows/t.yml | 20 ++++++++++++++++++++ actionlint/Dockerfile | 16 ++++++++++++++++ 2 files changed, 36 insertions(+) create mode 100644 .github/workflows/t.yml create mode 100644 actionlint/Dockerfile diff --git a/.github/workflows/t.yml b/.github/workflows/t.yml new file mode 100644 index 0000000..5dd89a0 --- /dev/null +++ b/.github/workflows/t.yml @@ -0,0 +1,20 @@ +name: Push Docker Image + +on: + push: + +jobs: + push: + name: Build and Push Docker Image + runs-on: ubuntu-latest + steps: + - name: Build and Push to DockerHub + uses: Mad-Pixels/github-workflows/.github/actions/dockerhub-build-push@main + with: + docker_user: ${{ secrets.DOCKERHUB_USERNAME }} + docker_token: ${{ secrets.DOCKERHUB_TOKEN }} + + tag: v1.7.7 + + repository: madpixels/actionlint + diff --git a/actionlint/Dockerfile b/actionlint/Dockerfile new file mode 100644 index 0000000..37cdb7d --- /dev/null +++ b/actionlint/Dockerfile @@ -0,0 +1,16 @@ +ARG ALPINE_VERSION=3.20 + +# build image -> +FROM --platform=$BUILDPLATFORM alpine:${ALPINE_VERSION} AS builder +RUN apk add --no-cache go git + +ENV GOPATH=/go \ + GOCACHE=/tmp/.cache \ + PATH=/go/bin:/usr/local/go/bin:$PATH +RUN go install github.com/rhysd/actionlint/cmd/actionlint@latest + +# final image -> +FROM --platform=$TARGETPLATFORM scratch +COPY --from=builder /go/bin/actionlint /actionlint +ENTRYPOINT ["/actionlint"] + From f2346aa119b9c0a79832cc0882e3ddeeebf78179 Mon Sep 17 00:00:00 2001 From: mr-chelyshkin Date: Tue, 5 Aug 2025 14:46:05 +0300 Subject: [PATCH 2/9] init --- .github/workflows/t.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/t.yml b/.github/workflows/t.yml index 5dd89a0..41f4287 100644 --- a/.github/workflows/t.yml +++ b/.github/workflows/t.yml @@ -12,7 +12,7 @@ jobs: uses: Mad-Pixels/github-workflows/.github/actions/dockerhub-build-push@main with: docker_user: ${{ secrets.DOCKERHUB_USERNAME }} - docker_token: ${{ secrets.DOCKERHUB_TOKEN }} + docker_token: ${{ secrets.DOCKERHUB_PASSWORD }} tag: v1.7.7 From 28c5b1bb09a0a726b8e41363fe7c98ef44a1804e Mon Sep 17 00:00:00 2001 From: mr-chelyshkin Date: Tue, 5 Aug 2025 14:49:44 +0300 Subject: [PATCH 3/9] init --- .github/workflows/t.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/t.yml b/.github/workflows/t.yml index 41f4287..538a1e5 100644 --- a/.github/workflows/t.yml +++ b/.github/workflows/t.yml @@ -16,5 +16,6 @@ jobs: tag: v1.7.7 + dockerfile_path: "./actionlint" repository: madpixels/actionlint From 0e7390a6281228d9cb44302b2f844537e5d9fac3 Mon Sep 17 00:00:00 2001 From: mr-chelyshkin Date: Tue, 5 Aug 2025 14:52:04 +0300 Subject: [PATCH 4/9] init --- .github/workflows/t.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/t.yml b/.github/workflows/t.yml index 538a1e5..053c71b 100644 --- a/.github/workflows/t.yml +++ b/.github/workflows/t.yml @@ -16,6 +16,6 @@ jobs: tag: v1.7.7 - dockerfile_path: "./actionlint" + context_path: "actionlint" repository: madpixels/actionlint From 272ff4e46c361e6ac76f5cd3a7f2cd82bbeb0e13 Mon Sep 17 00:00:00 2001 From: mr-chelyshkin Date: Tue, 5 Aug 2025 16:34:50 +0300 Subject: [PATCH 5/9] init --- .github/workflows/t.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/t.yml b/.github/workflows/t.yml index 053c71b..905148d 100644 --- a/.github/workflows/t.yml +++ b/.github/workflows/t.yml @@ -9,7 +9,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Build and Push to DockerHub - uses: Mad-Pixels/github-workflows/.github/actions/dockerhub-build-push@main + uses: Mad-Pixels/github-workflows/dockerhub-build-push@dev3 with: docker_user: ${{ secrets.DOCKERHUB_USERNAME }} docker_token: ${{ secrets.DOCKERHUB_PASSWORD }} From cc25b1f2e900c414e3b0ef439eba9d4a8c279cc5 Mon Sep 17 00:00:00 2001 From: mr-chelyshkin Date: Tue, 5 Aug 2025 19:45:32 +0300 Subject: [PATCH 6/9] init --- .github/workflows/t.yml | 32 +++++++++++++++++-------- Taskfile.yaml | 53 +++++++++++++++++++++++++++++++++++++++++ actionlint/Dockerfile | 8 +++---- 3 files changed, 79 insertions(+), 14 deletions(-) create mode 100644 Taskfile.yaml diff --git a/.github/workflows/t.yml b/.github/workflows/t.yml index 905148d..a1f11c7 100644 --- a/.github/workflows/t.yml +++ b/.github/workflows/t.yml @@ -7,15 +7,27 @@ jobs: push: name: Build and Push Docker Image runs-on: ubuntu-latest + steps: - - name: Build and Push to DockerHub - uses: Mad-Pixels/github-workflows/dockerhub-build-push@dev3 + - name: Checkout repo + uses: actions/checkout@v4 + + - name: Log in to GHCR + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + + - name: Set up Buildx + uses: docker/setup-buildx-action@v3 + with: + install: true + + - name: Invoke Taskfile + uses: Mad-Pixels/github-workflows/.github/actions/taskfile-runner@main with: - docker_user: ${{ secrets.DOCKERHUB_USERNAME }} - docker_token: ${{ secrets.DOCKERHUB_PASSWORD }} - - tag: v1.7.7 - - context_path: "actionlint" - repository: madpixels/actionlint - + command: actionlint VERSION=v1.7.7 \ No newline at end of file diff --git a/Taskfile.yaml b/Taskfile.yaml new file mode 100644 index 0000000..473b998 --- /dev/null +++ b/Taskfile.yaml @@ -0,0 +1,53 @@ +version: '3' + +vars: + git_root: + sh: git rev-parse --show-toplevel + + default_platforms: linux/amd64,linux/arm64 + image_alpine_ver: "3.20" + +tasks: + default: + desc: Show usage + cmds: + - echo "Please enter a task or use '-l' or '--list-all' to list all available tasks" + silent: true + +# ================================================# +# ---------------------INTERNAL-------------------# +# ================================================# + + _docker/buildx: + desc: Internal task to build multiarch images. + internal: true + silent: true + dir: "{{.git_root}}" + cmds: + - | + docker buildx build \ + --platform {{.platforms | default .default_platforms}} \ + --file {{.dockerfile | default (print .CONTEXT "/Dockerfile")}} \ + {{.BUILD_ARGS}} \ + -t madpixels/{{.CONTEXT}}:{{.TAG}} \ + -t madpixels/{{.CONTEXT}}:latest \ + --push \ + {{.context_path | default (print "./" .CONTEXT)}} + +# ================================================# +# ---------------------PUBLIC---------------------# +# ================================================# + + actionlint: + desc: Build actionlint image (multiarch) + vars: + VERSION: v1.7.7 + cmds: + - task: _docker/buildx + vars: + TAG: "{{.VERSION}}" + CONTEXT: actionlint + BUILD_ARGS: >- + --build-arg ALPINE_VERSION={{.image_alpine_ver}} + --build-arg ACTIONLINT_VER={{.VERSION}} + silent: true diff --git a/actionlint/Dockerfile b/actionlint/Dockerfile index 37cdb7d..4d1d472 100644 --- a/actionlint/Dockerfile +++ b/actionlint/Dockerfile @@ -1,16 +1,16 @@ -ARG ALPINE_VERSION=3.20 +ARG ALPINE_VERSION # build image -> FROM --platform=$BUILDPLATFORM alpine:${ALPINE_VERSION} AS builder -RUN apk add --no-cache go git +ARG ACTIONLINT_VER +RUN apk add --no-cache go git ENV GOPATH=/go \ GOCACHE=/tmp/.cache \ PATH=/go/bin:/usr/local/go/bin:$PATH -RUN go install github.com/rhysd/actionlint/cmd/actionlint@latest +RUN go install github.com/rhysd/actionlint/cmd/actionlint@${ACTIONLINT_VER} # final image -> FROM --platform=$TARGETPLATFORM scratch COPY --from=builder /go/bin/actionlint /actionlint ENTRYPOINT ["/actionlint"] - From 69acbf92879dc882126bc81de9ef766d12ffe1f7 Mon Sep 17 00:00:00 2001 From: mr-chelyshkin Date: Tue, 5 Aug 2025 19:48:26 +0300 Subject: [PATCH 7/9] init --- Taskfile.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Taskfile.yaml b/Taskfile.yaml index 473b998..f282ea2 100644 --- a/Taskfile.yaml +++ b/Taskfile.yaml @@ -29,8 +29,8 @@ tasks: --platform {{.platforms | default .default_platforms}} \ --file {{.dockerfile | default (print .CONTEXT "/Dockerfile")}} \ {{.BUILD_ARGS}} \ - -t madpixels/{{.CONTEXT}}:{{.TAG}} \ - -t madpixels/{{.CONTEXT}}:latest \ + -t ghcr.io/mad-pixels/{{.CONTEXT}}:{{.TAG}} \ + -t ghcr.io/mad-pixels/{{.CONTEXT}}:latest \ --push \ {{.context_path | default (print "./" .CONTEXT)}} From ce7418bc5b667d1aff3eabdff9334cfb34783ec7 Mon Sep 17 00:00:00 2001 From: mr-chelyshkin Date: Wed, 6 Aug 2025 06:32:04 +0300 Subject: [PATCH 8/9] init --- .github/workflows/.checks.yml | 29 ++++++++ .github/workflows/base_commint.yml | 26 ++++++++ .github/workflows/{t.yml => main_commit.yml} | 0 Taskfile.yaml | 70 ++++++++++++++++++-- actionlint/Dockerfile | 2 +- taskfile/Dockerfile | 14 ++++ 6 files changed, 136 insertions(+), 5 deletions(-) create mode 100644 .github/workflows/.checks.yml create mode 100644 .github/workflows/base_commint.yml rename .github/workflows/{t.yml => main_commit.yml} (100%) create mode 100644 taskfile/Dockerfile diff --git a/.github/workflows/.checks.yml b/.github/workflows/.checks.yml new file mode 100644 index 0000000..19906cc --- /dev/null +++ b/.github/workflows/.checks.yml @@ -0,0 +1,29 @@ +name: Checks + +on: + workflow_call: + secrets: + gitleaks: + required: true + +jobs: + lint: + name: Lint + runs-on: ${{ vars.RUNS_ON }} + steps: + - name: Invoke + uses: Mad-Pixels/github-workflows/.github/actions/taskfile-runner@main + with: + command: docker/lint + + leaks: + name: GitLeaks + runs-on: ${{ vars.RUNS_ON }} + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + - uses: gitleaks/gitleaks-action@v2 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITLEAKS_LICENSE: ${{ secrets.gitleaks }} diff --git a/.github/workflows/base_commint.yml b/.github/workflows/base_commint.yml new file mode 100644 index 0000000..8a27be3 --- /dev/null +++ b/.github/workflows/base_commint.yml @@ -0,0 +1,26 @@ +name: Base commit + +on: + push: + branches-ignore: + - main + +concurrency: + group: base-commit-${{ github.ref }} + cancel-in-progress: true + +jobs: + checks: + name: (Base) Commit Checks + uses: ./.github/workflows/.checks.yml + secrets: + gitleaks: ${{ secrets.GITLEAKS_LICENSE }} + + commit-check: + name: (Base) Commit Check + needs: checks + runs-on: ${{ vars.RUNS_ON }} + steps: + - name: All checks passed + run: | + echo "✅ All Commit checks completed successfully!" \ No newline at end of file diff --git a/.github/workflows/t.yml b/.github/workflows/main_commit.yml similarity index 100% rename from .github/workflows/t.yml rename to .github/workflows/main_commit.yml diff --git a/Taskfile.yaml b/Taskfile.yaml index f282ea2..efa5bfa 100644 --- a/Taskfile.yaml +++ b/Taskfile.yaml @@ -5,6 +5,7 @@ vars: sh: git rev-parse --show-toplevel default_platforms: linux/amd64,linux/arm64 + registry: "ghcr.io/mad-pixels" image_alpine_ver: "3.20" tasks: @@ -29,17 +30,48 @@ tasks: --platform {{.platforms | default .default_platforms}} \ --file {{.dockerfile | default (print .CONTEXT "/Dockerfile")}} \ {{.BUILD_ARGS}} \ - -t ghcr.io/mad-pixels/{{.CONTEXT}}:{{.TAG}} \ - -t ghcr.io/mad-pixels/{{.CONTEXT}}:latest \ + -t {{.registry}}/{{.CONTEXT}}:{{.TAG}} \ + -t {{.registry}}/{{.CONTEXT}}:latest \ --push \ {{.context_path | default (print "./" .CONTEXT)}} + _docker/run: + desc: Internal task to run secure container. + internal: true + silent: true + dir: "{{.git_root}}" + cmd: | + docker run --rm --init {{if .TTY}}-it{{end}} \ + --cap-drop=ALL \ + --security-opt no-new-privileges \ + --user $(id -u):$(id -g) \ + --workdir /workspace \ + {{if .ENVS}}{{range $env := .ENVS}}--env {{$env}} {{end}}{{end}}\ + {{if .PORTS}}{{range $port := .PORTS}}--publish {{$port}} {{end}}{{end}}\ + --volume "{{.git_root}}/{{.MOUNT_DIR}}:/workspace:rw" \ + {{.IMAGE}} \ + {{.CMD}} + requires: + vars: [IMAGE, CMD, MOUNT_DIR] + + _docker/lint: + desc: Execute hadolint on single Dockerfile. + internal: true + silent: true + dir: "{{.git_root}}" + cmds: + - task: _docker/run + vars: + IMAGE: "hadolint/hadolint" + MOUNT_DIR: "{{.DOCKERFILE_PATH | dir}}" + CMD: "hadolint {{.DOCKERFILE_PATH | base}}" + # ================================================# -# ---------------------PUBLIC---------------------# +# ---------------------IMAGES---------------------# # ================================================# actionlint: - desc: Build actionlint image (multiarch) + desc: Build actionlint image. vars: VERSION: v1.7.7 cmds: @@ -51,3 +83,33 @@ tasks: --build-arg ALPINE_VERSION={{.image_alpine_ver}} --build-arg ACTIONLINT_VER={{.VERSION}} silent: true + + taskfile: + desc: Build taskfile image. + vars: + VERSION: v3.44.1 + cmds: + - task: _docker/buildx + vars: + TAG: "{{.VERSION}}" + CONTEXT: taskfile + BUILD_ARGS: >- + --build-arg ALPINE_VERSION={{.image_alpine_ver}} + --build-arg TASK_VERSION={{.VERSION}} + silent: true + +# ================================================# +# ----------------------CI/CD---------------------# +# ================================================# + + docker/lint: + desc: Run hadolint for all Dockerfiles in the repo. + dir: "{{.git_root}}" + vars: + files: + sh: find . -type f -name Dockerfile + cmds: + - for: { var: files } + task: _docker/lint + vars: + DOCKERFILE_PATH: "{{.ITEM}}" diff --git a/actionlint/Dockerfile b/actionlint/Dockerfile index 4d1d472..27cf6f3 100644 --- a/actionlint/Dockerfile +++ b/actionlint/Dockerfile @@ -4,7 +4,7 @@ ARG ALPINE_VERSION FROM --platform=$BUILDPLATFORM alpine:${ALPINE_VERSION} AS builder ARG ACTIONLINT_VER -RUN apk add --no-cache go git +RUN apk add --no-cache go=latest git=latest ENV GOPATH=/go \ GOCACHE=/tmp/.cache \ PATH=/go/bin:/usr/local/go/bin:$PATH diff --git a/taskfile/Dockerfile b/taskfile/Dockerfile new file mode 100644 index 0000000..aacd0d5 --- /dev/null +++ b/taskfile/Dockerfile @@ -0,0 +1,14 @@ +ARG ALPINE_VERSION + +# build stage -> +FROM --platform=$BUILDPLATFORM alpine:${ALPINE_VERSION} AS builder +ARG TASK_VERSION + +SHELL ["/bin/ash", "-eo", "pipefail"] +RUN curl -sSL "https://github.com/go-task/task/releases/download/v${TASK_VERSION}/task_linux_$(uname -m).tar.gz" \ + | tar -xz -C /usr/local/bin task + +# final image -> +FROM --platform=$TARGETPLATFORM alpine:${ALPINE_VERSION} +COPY --from=builder /usr/local/bin/task /usr/local/bin/task +ENTRYPOINT ["task"] \ No newline at end of file From 006e86972a856569258f49b5b023fb48c3a37da0 Mon Sep 17 00:00:00 2001 From: mr-chelyshkin Date: Wed, 6 Aug 2025 12:12:00 +0300 Subject: [PATCH 9/9] init --- .github/workflows/.build.yml | 43 +++++++++++++++++++++++++++ .github/workflows/main_commit.yml | 48 +++++++++++++++++-------------- Taskfile.yaml | 12 ++++++++ 3 files changed, 82 insertions(+), 21 deletions(-) create mode 100644 .github/workflows/.build.yml diff --git a/.github/workflows/.build.yml b/.github/workflows/.build.yml new file mode 100644 index 0000000..9c9dda0 --- /dev/null +++ b/.github/workflows/.build.yml @@ -0,0 +1,43 @@ +name: Build + +description: Build and Push docker image. + +inputs: + docker_username: + description: 'Docker auth username' + required: true + docker_password: + description: 'Docker auth password' + required: true + image: + description: 'Image name / Taskfile command' + required: true + +runs: + using: "composite" + steps: + - name: Checkout repo + uses: actions/checkout@v4 + with: + fetch-depth: 1 + + - name: Log in to GHCR + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ inputs.docker_username }} + password: ${{ inputs.docker_password }} + + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + + - name: Set up Buildx + uses: docker/setup-buildx-action@v3 + with: + install: true + + - name: Invoke Taskfile + uses: Mad-Pixels/github-workflows/.github/actions/taskfile-runner@main + with: + command: ${{ inputs.image }} + diff --git a/.github/workflows/main_commit.yml b/.github/workflows/main_commit.yml index a1f11c7..60873aa 100644 --- a/.github/workflows/main_commit.yml +++ b/.github/workflows/main_commit.yml @@ -1,33 +1,39 @@ -name: Push Docker Image +name: Main commit on: push: + branches: + - main jobs: - push: - name: Build and Push Docker Image - runs-on: ubuntu-latest - + detect-changes: + name: Detect changed directories + runs-on: ${{ vars.RUNS_ON }} + outputs: + dirs: ${{ steps.get-changes.outputs.changes }} steps: - - name: Checkout repo - uses: actions/checkout@v4 + - uses: actions/checkout@v4 + with: + fetch-depth: 0 - - name: Log in to GHCR - uses: docker/login-action@v3 + - name: Get changes + id: get-changes + uses: Mad-Pixels/github-workflows/.github/actions/taskfile-runner@main with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} + command: changes - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 + build: + needs: detect-changes + if: ${{ needs.detect-changes.outputs.dirs != '' }} + runs-on: ${{ vars.RUNS_ON }} + strategy: + matrix: + dir: ${{ fromJson('["' + join('","', needs.detect-changes.outputs.dirs.split(' ')) + '"]') }} - - name: Set up Buildx - uses: docker/setup-buildx-action@v3 + steps: + - uses: ./.github/workflows/.build.yml with: - install: true + docker_username: ${{ github.actor }} + docker_password: ${{ secrets.GITHUB_TOKEN }} + image: ${{ matrix.dir }} - - name: Invoke Taskfile - uses: Mad-Pixels/github-workflows/.github/actions/taskfile-runner@main - with: - command: actionlint VERSION=v1.7.7 \ No newline at end of file diff --git a/Taskfile.yaml b/Taskfile.yaml index efa5bfa..a0e1873 100644 --- a/Taskfile.yaml +++ b/Taskfile.yaml @@ -113,3 +113,15 @@ tasks: task: _docker/lint vars: DOCKERFILE_PATH: "{{.ITEM}}" + + changes: + desc: Get changes Docker directories. + silent: true + cmds: + - | + CHANGES=$(git diff --name-only origin/main HEAD \ + | grep '^' \ + | cut -d '/' -f1 \ + | sort -u \ + | grep -E '^(actionlint|taskfile)' || true) + echo "changes=$(echo $CHANGES | xargs)" >> $GITHUB_OUTPUT