mirror of
https://github.com/mattermost/mattermost.git
synced 2026-02-21 17:00:50 -05:00
06b1bf3a51
* pin to ubuntu-24.04
* always use FIPS compatible Postgres settings
* use sha256 for remote cluster IDs
* use sha256 for client config hash
* rework S3 backend to be FIPS compatible
* skip setup-node during build, since already in container
* support FIPS builds
* Dockerfile for FIPS image, using glibc-openssl-fips
* workaround entrypoint inconsistencies
* authenticate to DockerHub
* fix FIPS_ENABLED, add test-mmctl-fips
* decouple check-mattermost-vet from test/build steps
* fixup! decouple check-mattermost-vet from test/build steps
* only build-linux-amd64 for fips
* rm entrypoint workaround
* tweak comment grammar
* rm unused Dockerfile.fips (for now)
* ignore gpg import errors, since would fail later anyway
* for fips, only make package-linux-amd64
* set FIPS_ENABLED for build step
* Add a FIPS-specific list of prepackaged plugins
Note that the names are still temporary, since they are not uploaded to
S3 yet. We may need to tweak them when that happens.
* s/golangci-lint/check-style/
This ensures we run all the `check-style` checks: previously,
`modernize` was missing.
* pin go-vet to @v2, remove annoying comment
* add -fips to linux-amd64.tz.gz package
* rm unused setup-chainctl
* use BUILD_TYPE_NAME instead
* mv fips build to enterprise-only
* fixup! use BUILD_TYPE_NAME instead
* temporarily pre-package no plugins for FIPS
* split package-cleanup
* undo package-cleanup, just skip ARM, also test
* skip arm for FIPS in second target too
* fmt Makefile
* Revert "rm unused Dockerfile.fips (for now)"
This reverts commit 601e37e0ff.
* reintroduce Dockerfile.fips and align with existing Dockerfile
* s/IMAGE/BUILD_IMAGE/
* bump the glibc-openssl-fips version
* rm redundant comment
* fix FIPS checks
* set PLUGIN_PACKAGES empty until prepackaged plugins ready
* upgrade glibc-openssl-fips, use non-dev version for final stage
* another BUILD_IMAGE case
* Prepackage the FIPS versions of plugins
* relocate FIPS_ENABLED initialization before use
* s/Config File MD5/Config File Hash/
* Update the FIPS plugin names and encode the + sign
* add /var/tmp for local socket manipulation
---------
Co-authored-by: Alejandro García Montoro <alejandro.garciamontoro@gmail.com>
Co-authored-by: Mattermost Build <build@mattermost.com>
98 lines
3.2 KiB
YAML
98 lines
3.2 KiB
YAML
# .github/workflows/dispatch-build.yml
|
|
name: Build & Push New Golang Docker Build Server Image
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
branch:
|
|
description: "Git branch or PR ref to build"
|
|
required: true
|
|
tag:
|
|
description: "Docker image tag (e.g. v1.2.3 or latest)"
|
|
required: true
|
|
|
|
env:
|
|
CHAINCTL_IDENTITY: ee399b4c72dd4e58e3d617f78fc47b74733c9557/922f2d48307d6f5f
|
|
|
|
# Permissions required for chainguard-dev/setup-chainctl
|
|
permissions:
|
|
id-token: write
|
|
contents: read
|
|
|
|
jobs:
|
|
build-and-push:
|
|
runs-on: ubuntu-24.04
|
|
env:
|
|
IMAGE_TAG: ${{ github.event.inputs.tag }}
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #4.2.2
|
|
with:
|
|
ref: ${{ github.event.inputs.branch }}
|
|
|
|
- name: Set up QEMU (optional, for multi-arch)
|
|
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca
|
|
|
|
- name: Login to DockerHub (development repo)
|
|
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
|
|
with:
|
|
registry: docker.io
|
|
username: ${{ secrets.DOCKERHUB_DEV_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_DEV_TOKEN }}
|
|
|
|
- name: Build & push development image
|
|
run: |
|
|
docker buildx build \
|
|
--tag mattermostdevelopment/mattermost-build-server:"${IMAGE_TAG}" \
|
|
--push \
|
|
-f server/build/Dockerfile.buildenv .
|
|
|
|
- name: Login to DockerHub (production repo)
|
|
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
|
|
with:
|
|
registry: docker.io
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- name: Build & push production image
|
|
run: |
|
|
docker buildx build \
|
|
--tag mattermost/mattermost-build-server:"${IMAGE_TAG}" \
|
|
--push \
|
|
-f server/build/Dockerfile.buildenv .
|
|
|
|
build-and-push-fips:
|
|
runs-on: ubuntu-24.04
|
|
|
|
steps:
|
|
- uses: chainguard-dev/setup-chainctl@f4ed65b781b048c44d4f033ae854c025c5531c19 # v0.3.2
|
|
with:
|
|
identity: ${{ env.CHAINCTL_IDENTITY }}
|
|
- name: Checkout code
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #4.2.2
|
|
with:
|
|
ref: ${{ github.event.inputs.branch }}
|
|
|
|
- name: Set up QEMU (optional, for multi-arch)
|
|
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca
|
|
|
|
- name: Login to DockerHub (production repo)
|
|
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772
|
|
with:
|
|
registry: docker.io
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- name: Build & push production image
|
|
run: |
|
|
docker buildx build \
|
|
--tag mattermost/mattermost-build-server-fips:${{ github.event.inputs.tag }} \
|
|
--push \
|
|
-f server/build/Dockerfile.buildenv-fips .
|