mirror of
https://github.com/docker/compose.git
synced 2026-10-12 02:13:08 +00:00
Guillaume Lours
ea82c55224
Replace the long-lived DOCKERPUBLICBOT PAT with short-lived tokens minted through the Docker Hub OIDC connection, using the registry-identities input of the github-builder bake workflow. The connection rulesets cover both triggers of this workflow (refs/heads/main and refs/tags/v*) for compose-bin and compose-desktop-module. Signed-off-by: Guillaume Lours <[email protected]>
81 lines
2.2 KiB
YAML
81 lines
2.2 KiB
YAML
name: merge
|
|
|
|
permissions:
|
|
contents: read # to fetch code (actions/checkout)
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- 'main'
|
|
tags:
|
|
- 'v*'
|
|
|
|
env:
|
|
REPO_SLUG: "docker/compose-bin"
|
|
|
|
jobs:
|
|
bin-image-prepare:
|
|
runs-on: ubuntu-24.04
|
|
outputs:
|
|
repo-slug: ${{ env.REPO_SLUG }}
|
|
steps:
|
|
# FIXME: can't use env object in reusable workflow inputs: https://github.com/orgs/community/discussions/26671
|
|
- run: echo "Exposing env vars for reusable workflow"
|
|
|
|
bin-image:
|
|
uses: docker/github-builder/.github/workflows/bake.yml@27ade872c1e2296e62ef15ab3b10d37665e57cf7 # v1.15.0
|
|
needs:
|
|
- bin-image-prepare
|
|
permissions:
|
|
contents: read # same as global permission
|
|
id-token: write # for signing attestation(s) with GitHub OIDC Token
|
|
with:
|
|
runner: amd64
|
|
target: image-cross
|
|
cache: true
|
|
cache-scope: bin-image
|
|
output: image
|
|
push: true # this workflow only triggers on push (main and tags)
|
|
sbom: true
|
|
set-meta-labels: true
|
|
meta-images: |
|
|
${{ needs.bin-image-prepare.outputs.repo-slug }}
|
|
meta-tags: |
|
|
type=ref,event=tag
|
|
type=edge
|
|
meta-bake-target: meta-helper
|
|
registry-identities: |
|
|
- type: dockerhub
|
|
username: docker
|
|
connection_id: a295c8b7-54ab-4507-ac88-5c43003c73a5
|
|
|
|
module-image:
|
|
uses: docker/github-builder/.github/workflows/bake.yml@27ade872c1e2296e62ef15ab3b10d37665e57cf7 # v1.15.0
|
|
permissions:
|
|
contents: read # same as global permission
|
|
id-token: write # for signing attestation(s) with GitHub OIDC Token
|
|
with:
|
|
runner: amd64
|
|
target: image-module-cross
|
|
cache: true
|
|
cache-scope: module-image
|
|
output: image
|
|
push: ${{ startsWith(github.ref, 'refs/tags/v') }}
|
|
sbom: true
|
|
set-meta-labels: true
|
|
meta-images: |
|
|
docker/compose-desktop-module
|
|
meta-tags: |
|
|
type=ref,event=branch
|
|
type=ref,event=tag
|
|
meta-bake-target: meta-helper
|
|
registry-identities: |
|
|
- type: dockerhub
|
|
username: docker
|
|
connection_id: a295c8b7-54ab-4507-ac88-5c43003c73a5
|
|
|
|
|