Skip to content

Commit 8d7f242

Browse files
lucacomelucacome
committed
Build NGINX Plus images
Problem: Building the NGINX Plus image is a manual step Solution: Add automated build in the pipeline
1 parent cadbb72 commit 8d7f242

File tree

12 files changed

+195
-180
lines changed

12 files changed

+195
-180
lines changed

‎.github/workflows/build.yml

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
name: Build
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
platforms:
7+
required: true
8+
type: string
9+
image:
10+
required: true
11+
type: string
12+
tag:
13+
required: false
14+
type: string
15+
16+
defaults:
17+
run:
18+
shell: bash
19+
20+
permissions:
21+
contents: read
22+
23+
jobs:
24+
build:
25+
permissions:
26+
contents: read # for docker/build-push-action to read repo content
27+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
28+
packages: write # for docker/build-push-action to push to GHCR
29+
id-token: write # for docker/login to login to NGINX registry
30+
runs-on: ${{ github.event_name != 'pull_request' && contains(inputs.image, 'plus') && 'kic-plus' || 'ubuntu-22.04' }}
31+
services:
32+
registry:
33+
image: registry:2
34+
ports:
35+
- 5000:5000
36+
steps:
37+
- name: Checkout Repository
38+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
39+
with:
40+
ref: ${{ inputs.tag != '' && format('refs/tags/v{0}', inputs.tag) || github.ref }}
41+
42+
- name: Fetch Cached Artifacts
43+
uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
44+
with:
45+
path: ${{ github.workspace }}/dist
46+
key: nginx-gateway-fabric-${{ github.run_id }}-${{ github.run_number }}
47+
48+
- name: Docker Buildx
49+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
50+
with:
51+
driver-opts: network=host
52+
53+
- name: Setup QEMU
54+
uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
55+
with:
56+
platforms: arm64
57+
58+
- name: Login to GitHub Container Registry
59+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
60+
if: ${{ github.event_name != 'pull_request' && ! contains(inputs.image, 'plus') }}
61+
with:
62+
registry: ghcr.io
63+
username: ${{ github.repository_owner }}
64+
password: ${{ secrets.GITHUB_TOKEN }}
65+
66+
- name: Get Id Token
67+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
68+
id: idtoken
69+
with:
70+
script: |
71+
let id_token = await core.getIDToken()
72+
core.setOutput('id_token', id_token)
73+
if: ${{ github.event_name != 'pull_request' && contains(inputs.image, 'plus')}}
74+
75+
- name: Login to NGINX Registry
76+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
77+
with:
78+
registry: docker-mgmt.nginx.com
79+
username: ${{ steps.idtoken.outputs.id_token }}
80+
password: ${{ github.actor }}
81+
if: ${{ github.event_name != 'pull_request' && contains(inputs.image, 'plus') }}
82+
83+
- name: Docker meta
84+
id: meta
85+
uses: docker/metadata-action@dbef88086f6cef02e264edb7dbf63250c17cef6c # v5.5.0
86+
with:
87+
images: |
88+
name=ghcr.io/nginxinc/nginx-gateway-fabric,enable=${{ inputs.image == 'ngf' && github.event_name != 'pull_request' }}
89+
name=ghcr.io/nginxinc/nginx-gateway-fabric/nginx,enable=${{ inputs.image == 'nginx' && github.event_name != 'pull_request' }}
90+
name=docker-mgmt.nginx.com/nginx-gateway-fabric/nginx-plus,enable=${{ inputs.image == 'nginx-plus' && github.event_name != 'pull_request' }}
91+
name=localhost:5000/nginx-gateway-fabric/${{ inputs.image }}
92+
flavor: |
93+
latest=${{ (inputs.tag != '' && 'true') || 'auto' }}
94+
tags: |
95+
type=semver,pattern={{version}}
96+
type=edge
97+
type=ref,event=pr
98+
type=ref,event=branch,suffix=-rc,enable=${{ startsWith(github.ref, 'refs/heads/release') }}
99+
type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }}
100+
labels: |
101+
org.opencontainers.image.documentation=https://docs.nginx.com/nginx-gateway-fabric
102+
org.opencontainers.image.vendor=NGINX Inc <kubernetes@nginx.com>
103+
env:
104+
DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
105+
106+
- name: Build Docker Image
107+
uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0
108+
with:
109+
file: build/Dockerfile${{ inputs.image == 'nginx' && '.nginx' || '' }}${{ inputs.image == 'nginx-plus' && '.nginxplus' || '' }}
110+
context: "."
111+
target: ${{ inputs.image == 'ngf' && 'goreleaser' || '' }}
112+
tags: ${{ steps.meta.outputs.tags }}
113+
labels: ${{ steps.meta.outputs.labels }}
114+
annotations: ${{ steps.meta.outputs.annotations }}
115+
push: true
116+
platforms: ${{ inputs.platforms }}
117+
cache-from: type=gha,scope=${{ inputs.image }}
118+
cache-to: type=gha,scope=${{ inputs.image }},mode=max
119+
pull: true
120+
no-cache: ${{ github.event_name != 'pull_request' }}
121+
sbom: true
122+
provenance: true
123+
build-args: |
124+
NJS_DIR=internal/mode/static/nginx/modules/src
125+
NGINX_CONF_DIR=internal/mode/static/nginx/conf
126+
BUILD_AGENT=gha
127+
secrets: |
128+
${{ contains(inputs.image, 'plus') && format('"nginx-repo.crt={0}"', secrets.NGINX_CRT) || '' }}
129+
${{ contains(inputs.image, 'plus') && format('"nginx-repo.key={0}"', secrets.NGINX_KEY) || '' }}
130+
131+
- name: Inspect SBOM
132+
run: |
133+
docker buildx imagetools inspect localhost:5000/nginx-gateway-fabric/${{ inputs.image }}:${{ steps.meta.outputs.version }} --format '{{ json (index .SBOM "linux/amd64").SPDX }}' > sbom-${{ inputs.image }}.json
134+
135+
- name: Scan SBOM
136+
id: scan
137+
uses: anchore/scan-action@1d59d90b47fc11ff8f97822da6c25eec888f81cf # v3.5.0
138+
with:
139+
sbom: "sbom-${{ inputs.image }}.json"
140+
only-fixed: true
141+
add-cpes-if-none: true
142+
143+
- name: Upload scan result to GitHub Security tab
144+
uses: github/codeql-action/upload-sarif@e5f05b81d5b6ff8cfa111c80c22c5fd02a384118 # v3.23.0
145+
continue-on-error: true
146+
with:
147+
sarif_file: ${{ steps.scan.outputs.sarif }}
148+
149+
- name: Upload Scan Results
150+
uses: actions/upload-artifact@1eb3cb2b3e0f29609092a73eb033bb759a334595 # v4.1.0
151+
continue-on-error: true
152+
with:
153+
name: scan-results-${{ inputs.image }}.sarif
154+
path: ${{ steps.scan.outputs.sarif }}
155+
if: always()

‎.github/workflows/ci.yml

Lines changed: 8 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,6 @@ concurrency:
1717
group: ${{ github.ref_name }}-ci
1818
cancel-in-progress: true
1919

20-
env:
21-
platforms: "linux/arm64, linux/amd64"
22-
2320
permissions:
2421
contents: read
2522

@@ -245,97 +242,22 @@ jobs:
245242

246243
build:
247244
name: Build Image
248-
runs-on: ubuntu-22.04
249245
needs: [vars, binary]
250246
strategy:
251247
fail-fast: false
252248
matrix:
253-
container: [ngf, nginx]
249+
image: [ngf, nginx, nginx-plus]
250+
platforms: ["linux/arm64, linux/amd64"]
251+
uses: ./.github/workflows/build.yml
252+
with:
253+
image: ${{ matrix.image }}
254+
platforms: ${{ matrix.platforms }}
254255
permissions:
255256
contents: read # for docker/build-push-action to read repo content
256257
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
257258
packages: write # for docker/build-push-action to push to GHCR
258-
steps:
259-
- name: Checkout Repository
260-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
261-
262-
- name: Fetch Cached Artifacts
263-
uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
264-
with:
265-
path: ${{ github.workspace }}/dist
266-
key: nginx-gateway-fabric-${{ github.run_id }}-${{ github.run_number }}
267-
268-
- name: Docker Buildx
269-
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
270-
271-
- name: Setup QEMU
272-
uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
273-
with:
274-
platforms: arm64
275-
276-
- name: Login to GitHub Container Registry
277-
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
278-
if: ${{ github.event_name != 'pull_request' }}
279-
with:
280-
registry: ghcr.io
281-
username: ${{ github.repository_owner }}
282-
password: ${{ secrets.GITHUB_TOKEN }}
283-
284-
- name: Docker meta
285-
id: meta
286-
uses: docker/metadata-action@dbef88086f6cef02e264edb7dbf63250c17cef6c # v5.5.0
287-
with:
288-
images: |
289-
name=ghcr.io/nginxinc/nginx-gateway-fabric${{ matrix.container == 'nginx' && '/nginx' || '' }}
290-
tags: |
291-
type=semver,pattern={{version}}
292-
type=edge
293-
type=ref,event=pr
294-
type=ref,event=branch,suffix=-rc,enable=${{ startsWith(github.ref, 'refs/heads/release') }}
295-
296-
- name: Build Docker Image
297-
uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0
298-
with:
299-
file: ${{ matrix.container == 'nginx' && 'build/Dockerfile.nginx' || 'build/Dockerfile' }}
300-
context: "."
301-
target: ${{ matrix.container == 'ngf' && 'goreleaser' || '' }}
302-
tags: ${{ steps.meta.outputs.tags }}
303-
labels: ${{ steps.meta.outputs.labels }}
304-
load: ${{ github.event_name == 'pull_request' }}
305-
push: ${{ github.event_name != 'pull_request' }}
306-
platforms: ${{ github.event_name != 'pull_request' && env.platforms || '' }}
307-
cache-from: type=gha,scope=${{ matrix.container }}
308-
cache-to: type=gha,scope=${{ matrix.container }},mode=max
309-
pull: true
310-
no-cache: ${{ github.event_name != 'pull_request' }}
311-
sbom: ${{ github.event_name != 'pull_request' }}
312-
provenance: false
313-
build-args: |
314-
NJS_DIR=internal/mode/static/nginx/modules/src
315-
NGINX_CONF_DIR=internal/mode/static/nginx/conf
316-
317-
- name: Run Trivy vulnerability scanner
318-
uses: aquasecurity/trivy-action@d43c1f16c00cfd3978dde6c07f4bbcf9eb6993ca # 0.16.1
319-
continue-on-error: true
320-
with:
321-
image-ref: ghcr.io/nginxinc/nginx-gateway-fabric${{ matrix.container == 'nginx' && '/nginx' || '' }}:${{ steps.meta.outputs.version }}
322-
format: "sarif"
323-
output: trivy-results-nginx-gateway-fabric${{ matrix.container == 'nginx' && '-nginx' || '' }}.sarif
324-
ignore-unfixed: "true"
325-
326-
- name: Upload Trivy scan results to GitHub Security tab
327-
uses: github/codeql-action/upload-sarif@b7bf0a3ed3ecfa44160715d7c442788f65f0f923 # v3.23.2
328-
continue-on-error: true
329-
with:
330-
sarif_file: trivy-results-nginx-gateway-fabric${{ matrix.container == 'nginx' && '-nginx' || '' }}.sarif
331-
332-
- name: Upload Scan Results
333-
uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
334-
continue-on-error: true
335-
with:
336-
name: trivy-results-nginx-gateway-fabric${{ matrix.container == 'nginx' && '-nginx' || '' }}.sarif
337-
path: trivy-results-nginx-gateway-fabric${{ matrix.container == 'nginx' && '-nginx' || '' }}.sarif
338-
if: always()
259+
id-token: write # for docker/login to login to NGINX registry
260+
secrets: inherit
339261

340262
publish-helm:
341263
name: Package and Publish Helm Chart

‎.github/workflows/update-docker-images.yml

Lines changed: 7 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,6 @@ concurrency:
1515
permissions:
1616
contents: read
1717

18-
env:
19-
platforms: "linux/arm64, linux/amd64"
20-
2118
jobs:
2219
variables:
2320
name: Get versions of base images
@@ -61,86 +58,22 @@ jobs:
6158
with:
6259
base-image: ${{ needs.variables.outputs.nginx_version }}
6360
image: ghcr.io/nginxinc/nginx-gateway-fabric/nginx:${{ needs.variables.outputs.ngf_tag }}
64-
platforms: ${{ env.platforms }}
61+
platforms: "linux/arm64, linux/amd64"
6562

6663
- id: needs
6764
run: echo "needs-updating=${{ steps.update.outputs.needs-updating }}" >> $GITHUB_OUTPUT
6865

6966
build:
7067
name: Build Image
71-
runs-on: ubuntu-22.04
7268
needs: [variables, check]
7369
if: ${{ needs.check.outputs.needs-updating }}
74-
strategy:
75-
fail-fast: false
70+
uses: ./.github/workflows/build.yml
71+
with:
72+
image: nginx
73+
platforms: "linux/arm64, linux/amd64"
74+
tag: ${{ needs.variables.outputs.ngf_tag }}
7675
permissions:
7776
contents: read # for docker/build-push-action to read repo content
7877
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
7978
packages: write # for docker/build-push-action to push to GHCR
80-
steps:
81-
- name: Checkout Repository
82-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
83-
84-
- name: Docker Buildx
85-
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
86-
87-
- name: Setup QEMU
88-
uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
89-
with:
90-
platforms: arm64
91-
92-
- name: Login to GitHub Container Registry
93-
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
94-
with:
95-
registry: ghcr.io
96-
username: ${{ github.repository_owner }}
97-
password: ${{ secrets.GITHUB_TOKEN }}
98-
99-
- name: Docker meta
100-
id: meta
101-
uses: docker/metadata-action@dbef88086f6cef02e264edb7dbf63250c17cef6c # v5.5.0
102-
with:
103-
images: |
104-
name=ghcr.io/nginxinc/nginx-gateway-fabric/nginx
105-
tags: |
106-
${{ needs.variables.outputs.ngf_tag }}
107-
108-
- name: Build Docker Image
109-
uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0
110-
with:
111-
file: 'build/Dockerfile.nginx'
112-
context: "."
113-
tags: ${{ steps.meta.outputs.tags }}
114-
labels: ${{ steps.meta.outputs.labels }}
115-
push: true
116-
platforms: ${{ env.platforms }}
117-
pull: true
118-
no-cache: true
119-
sbom: true
120-
provenance: false
121-
build-args: |
122-
NJS_DIR=internal/mode/static/nginx/modules/src
123-
NGINX_CONF_DIR=internal/mode/static/nginx/conf
124-
125-
- name: Run Trivy vulnerability scanner
126-
uses: aquasecurity/trivy-action@d43c1f16c00cfd3978dde6c07f4bbcf9eb6993ca # 0.16.1
127-
continue-on-error: true
128-
with:
129-
image-ref: ghcr.io/nginxinc/nginx-gateway-fabric/nginx:${{ needs.variables.outputs.ngf_tag }}
130-
format: "sarif"
131-
output: trivy-results-nginx-gateway-fabric-nginx
132-
ignore-unfixed: "true"
133-
134-
- name: Upload Trivy scan results to GitHub Security tab
135-
uses: github/codeql-action/upload-sarif@b7bf0a3ed3ecfa44160715d7c442788f65f0f923 # v3.23.2
136-
continue-on-error: true
137-
with:
138-
sarif_file: trivy-results-nginx-gateway-fabric-nginx
139-
140-
- name: Upload Scan Results
141-
uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
142-
continue-on-error: true
143-
with:
144-
name: trivy-results-nginx-gateway-fabric-nginx
145-
path: trivy-results-nginx-gateway-fabric-nginx
146-
if: always()
79+
id-token: write # for docker/login to login to NGINX registry

‎Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ GO_LINKER_FLAGS = $(GO_LINKER_FLAGS_OPTIMIZATIONS) $(GO_LINKER_FlAGS_VARS)
2020
# variables that can be overridden by the user
2121
PREFIX ?= nginx-gateway-fabric## The name of the NGF image. For example, nginx-gateway-fabric
2222
NGINX_PREFIX ?= $(PREFIX)/nginx## The name of the nginx image. For example: nginx-gateway-fabric/nginx
23-
NGINX_PLUS_PREFIX ?= $(PREFIX)/nginxplus## The name of the nginx plus image. For example: nginx-gateway-fabric/nginxplus
23+
NGINX_PLUS_PREFIX ?= $(PREFIX)/nginx-plus## The name of the nginx plus image. For example: nginx-gateway-fabric/nginx-plus
2424
TAG ?= $(VERSION:v%=%)## The tag of the image. For example, 0.3.0
2525
TARGET ?= local## The target of the build. Possible values: local and container
2626
KIND_KUBE_CONFIG=$${HOME}/.kube/kind/config## The location of the kind kubeconfig

‎build/Dockerfile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# syntax=docker/dockerfile:1.4
1+
# syntax=docker/dockerfile:1.6
22
FROM golang:1.21 as builder
33

44
WORKDIR /go/src/github.com/nginxinc/nginx-gateway-fabric

‎build/Dockerfile.nginx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# syntax=docker/dockerfile:1.4
1+
# syntax=docker/dockerfile:1.6
22
FROM nginx:1.25.3-alpine
33

44
ARG NJS_DIR

0 commit comments

Comments
 (0)