Add versioned tags with auto-incrementing build number
Some checks failed
Weekly Rebuild (CVE Updates) / rebuild (apko/dotnet-sdk.yaml, dotnet-sdk) (push) Waiting to run
Weekly Rebuild (CVE Updates) / rebuild (apko/flutter-sdk.yaml, flutter-sdk) (push) Waiting to run
Check for Upstream Stable Updates / Rebuild and push all variants (apko/base.yaml, base) (push) Blocked by required conditions
Check for Upstream Stable Updates / Rebuild and push all variants (apko/build.yaml, build) (push) Blocked by required conditions
Check for Upstream Stable Updates / Rebuild and push all variants (apko/dotnet-runtime.yaml, dotnet-runtime) (push) Blocked by required conditions
Check for Upstream Stable Updates / Rebuild and push all variants (apko/dotnet-sdk.yaml, dotnet-sdk) (push) Blocked by required conditions
Check for Upstream Stable Updates / Rebuild and push all variants (apko/flutter-sdk.yaml, flutter-sdk) (push) Blocked by required conditions
Check for Upstream Stable Updates / Check Wolfi package updates (push) Waiting to run
Check for Upstream Stable Updates / Check .NET stable releases (push) Waiting to run
Check for Upstream Stable Updates / Check Flutter stable releases (push) Waiting to run
Check for Upstream Stable Updates / Create release for new Flutter version (push) Blocked by required conditions
Build and Push Base Distro Images / build-and-push (apko/base.yaml, base) (push) Failing after 27s
Build and Push Base Distro Images / build-and-push (apko/build.yaml, build) (push) Failing after 29s
Build and Push Base Distro Images / build-and-push (apko/dotnet-runtime.yaml, dotnet-runtime) (push) Failing after 35s
Build and Push Base Distro Images / build-and-push (apko/dotnet-sdk.yaml, dotnet-sdk) (push) Failing after 32s
Build and Push Base Distro Images / build-and-push (apko/flutter-sdk.yaml, flutter-sdk) (push) Failing after 26s
Weekly Rebuild (CVE Updates) / rebuild (apko/base.yaml, base) (push) Failing after 25s
Weekly Rebuild (CVE Updates) / rebuild (apko/dotnet-runtime.yaml, dotnet-runtime) (push) Has been cancelled
Weekly Rebuild (CVE Updates) / rebuild (apko/build.yaml, build) (push) Has been cancelled

Each variant now gets a versioned tag alongside -latest:
- base/build: glibc version (e.g. base-2.42.1, base-2.42.2)
- dotnet-runtime: .NET runtime version (e.g. dotnet-runtime-10.0.0.1)
- dotnet-sdk: .NET SDK version (e.g. dotnet-sdk-10.0.100.1)
- flutter-sdk: Flutter version (e.g. flutter-sdk-3.38.9.1)

The build number auto-increments by querying existing tags on
DockerHub. Also fixes provenance JSON (use jq instead of heredoc)
and adds push-on-self triggers for publish/rebuild pipelines.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Mathias Beaulieu-Duncan 2026-02-02 10:19:42 -05:00
parent dcedc113e8
commit b3372fce38
3 changed files with 181 additions and 15 deletions

View File

@ -3,7 +3,9 @@ name: Build and Push Base Distro Images
on:
release:
types: [published, prereleased]
workflow_dispatch:
push:
paths:
- '.gitea/workflows/publish.yaml'
permissions:
contents: read
@ -31,7 +33,7 @@ jobs:
- name: Checkout code
uses: actions/checkout@v3
- name: Determine tag
- name: Determine tag type
id: tag
run: |
if [[ "${{ github.event.release.prerelease }}" == "true" ]]; then
@ -64,16 +66,69 @@ jobs:
username: ${{ secrets.REGISTRY_USERNAME }}
password: ${{ secrets.REGISTRY_PASSWORD }}
- name: Determine upstream version
id: version
run: |
VARIANT="${{ matrix.variant }}"
case "$VARIANT" in
base|build)
UPSTREAM=$(apko resolve ${{ matrix.config }} 2>&1 | grep -oP 'glibc-\K[0-9]+\.[0-9]+' | head -1 || echo "0.0")
if [ "$UPSTREAM" = "" ] || [ "$UPSTREAM" = "0.0" ]; then
UPSTREAM=$(apko resolve ${{ matrix.config }} 2>&1 | grep -oP 'glibc \(\K[0-9]+\.[0-9]+' | head -1 || echo "2.42")
fi
;;
dotnet-runtime)
UPSTREAM=$(curl -fsSL "https://dotnetcli.azureedge.net/dotnet/release-metadata/releases-index.json" \
| jq -r '[."releases-index"[] | select(."support-phase" == "active" or ."support-phase" == "go-live") | ."latest-runtime"] | sort_by(. | split(".") | map(tonumber)) | last')
;;
dotnet-sdk)
UPSTREAM=$(curl -fsSL "https://dotnetcli.azureedge.net/dotnet/release-metadata/releases-index.json" \
| jq -r '[."releases-index"[] | select(."support-phase" == "active" or ."support-phase" == "go-live") | ."latest-sdk"] | sort_by(. | split(".") | map(tonumber)) | last')
;;
flutter-sdk)
UPSTREAM=$(curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/releases_linux.json" \
| jq -r '.current_release.stable as $hash | .releases[] | select(.hash == $hash and .channel == "stable") | .version')
;;
esac
echo "upstream=${UPSTREAM}" >> "$GITHUB_OUTPUT"
echo "Upstream version for ${VARIANT}: ${UPSTREAM}"
# Query DockerHub for existing tags to determine build increment
REPO_NAME="${{ env.IMAGE_NAME }}"
REGISTRY_URL="${{ secrets.REGISTRY_URL }}"
NAMESPACE=$(echo "$REGISTRY_URL" | sed 's|.*://||; s|.*\.io/||; s|/$||')
EXISTING_TAGS=$(curl -s "https://hub.docker.com/v2/repositories/${NAMESPACE}/${REPO_NAME}/tags?page_size=100&name=${VARIANT}-${UPSTREAM}." \
| jq -r '.results[]?.name // empty' 2>/dev/null || echo "")
MAX_BUILD=0
for tag in $EXISTING_TAGS; do
BUILD_NUM=$(echo "$tag" | grep -oP "\.\K[0-9]+$" || echo "0")
if [ "$BUILD_NUM" -gt "$MAX_BUILD" ] 2>/dev/null; then
MAX_BUILD=$BUILD_NUM
fi
done
NEXT_BUILD=$((MAX_BUILD + 1))
VERSION_TAG="${VARIANT}-${UPSTREAM}.${NEXT_BUILD}"
echo "version_tag=${VERSION_TAG}" >> "$GITHUB_OUTPUT"
echo "Next version tag: ${VERSION_TAG}"
- name: Build and push image
id: publish
run: |
IMAGE_REF=${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-${{ steps.tag.outputs.suffix }}
IMAGE_LATEST=${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-${{ steps.tag.outputs.suffix }}
IMAGE_VERSIONED=${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version_tag }}
mkdir -p /tmp/sbom
apko publish ${{ matrix.config }} \
--sbom-path /tmp/sbom \
--image-refs /tmp/image-refs.txt \
"${IMAGE_REF}"
echo "image_ref=${IMAGE_REF}" >> "$GITHUB_OUTPUT"
"${IMAGE_LATEST}" \
"${IMAGE_VERSIONED}"
echo "image_ref=${IMAGE_LATEST}" >> "$GITHUB_OUTPUT"
echo "image_versioned=${IMAGE_VERSIONED}" >> "$GITHUB_OUTPUT"
DIGEST=$(head -1 /tmp/image-refs.txt | sed 's/.*@//')
echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
@ -82,7 +137,6 @@ jobs:
COSIGN_YES: "true"
run: |
IMAGE_DIGEST="${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}@${{ steps.publish.outputs.digest }}"
# Attach SPDX SBOM
SBOM_FILE=$(ls /tmp/sbom/*.spdx.json 2>/dev/null | head -1)
if [ -n "$SBOM_FILE" ]; then
cosign attach sbom --sbom "${SBOM_FILE}" "${IMAGE_DIGEST}"
@ -100,7 +154,7 @@ jobs:
jq -n \
--arg type "https://in-toto.io/Statement/v0.1" \
--arg predType "https://slsa.dev/provenance/v0.2" \
--arg name "${{ steps.publish.outputs.image_ref }}" \
--arg name "${{ steps.publish.outputs.image_versioned }}" \
--arg sha "$DIGEST_SHA" \
--arg builder "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
--arg buildType "https://apko.dev/build/v1" \

View File

@ -58,16 +58,76 @@ jobs:
username: ${{ secrets.REGISTRY_USERNAME }}
password: ${{ secrets.REGISTRY_PASSWORD }}
- name: Determine upstream version
id: version
run: |
VARIANT="${{ matrix.variant }}"
case "$VARIANT" in
base|build)
# Use Wolfi glibc version as base version
UPSTREAM=$(apko resolve ${{ matrix.config }} 2>&1 | grep -oP 'glibc-\K[0-9]+\.[0-9]+' | head -1 || echo "0.0")
if [ "$UPSTREAM" = "" ] || [ "$UPSTREAM" = "0.0" ]; then
UPSTREAM=$(apko resolve ${{ matrix.config }} 2>&1 | grep -oP 'glibc \(\K[0-9]+\.[0-9]+' | head -1 || echo "2.42")
fi
;;
dotnet-runtime)
# Use latest .NET runtime version
UPSTREAM=$(curl -fsSL "https://dotnetcli.azureedge.net/dotnet/release-metadata/releases-index.json" \
| jq -r '[."releases-index"[] | select(."support-phase" == "active" or ."support-phase" == "go-live") | ."latest-runtime"] | sort_by(. | split(".") | map(tonumber)) | last')
;;
dotnet-sdk)
# Use latest .NET SDK version
UPSTREAM=$(curl -fsSL "https://dotnetcli.azureedge.net/dotnet/release-metadata/releases-index.json" \
| jq -r '[."releases-index"[] | select(."support-phase" == "active" or ."support-phase" == "go-live") | ."latest-sdk"] | sort_by(. | split(".") | map(tonumber)) | last')
;;
flutter-sdk)
# Use latest Flutter stable version
UPSTREAM=$(curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/releases_linux.json" \
| jq -r '.current_release.stable as $hash | .releases[] | select(.hash == $hash and .channel == "stable") | .version')
;;
esac
echo "upstream=${UPSTREAM}" >> "$GITHUB_OUTPUT"
echo "Upstream version for ${VARIANT}: ${UPSTREAM}"
# Query DockerHub for existing tags to determine build increment
REPO_NAME="${{ env.IMAGE_NAME }}"
REGISTRY_URL="${{ secrets.REGISTRY_URL }}"
# Extract namespace/repo from registry URL (e.g. docker.io/svrnty -> svrnty)
NAMESPACE=$(echo "$REGISTRY_URL" | sed 's|.*://||; s|.*\.io/||; s|/$||')
# Query DockerHub API for tags matching this variant and version
EXISTING_TAGS=$(curl -s "https://hub.docker.com/v2/repositories/${NAMESPACE}/${REPO_NAME}/tags?page_size=100&name=${VARIANT}-${UPSTREAM}." \
| jq -r '.results[]?.name // empty' 2>/dev/null || echo "")
# Find highest build number
MAX_BUILD=0
for tag in $EXISTING_TAGS; do
BUILD_NUM=$(echo "$tag" | grep -oP "\.\K[0-9]+$" || echo "0")
if [ "$BUILD_NUM" -gt "$MAX_BUILD" ] 2>/dev/null; then
MAX_BUILD=$BUILD_NUM
fi
done
NEXT_BUILD=$((MAX_BUILD + 1))
VERSION_TAG="${VARIANT}-${UPSTREAM}.${NEXT_BUILD}"
echo "version_tag=${VERSION_TAG}" >> "$GITHUB_OUTPUT"
echo "Next version tag: ${VERSION_TAG}"
- name: Rebuild and push with latest Wolfi packages
id: publish
run: |
IMAGE_REF=${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-latest
IMAGE_LATEST=${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-latest
IMAGE_VERSIONED=${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version_tag }}
mkdir -p /tmp/sbom
apko publish ${{ matrix.config }} \
--sbom-path /tmp/sbom \
--image-refs /tmp/image-refs.txt \
"${IMAGE_REF}"
echo "image_ref=${IMAGE_REF}" >> "$GITHUB_OUTPUT"
"${IMAGE_LATEST}" \
"${IMAGE_VERSIONED}"
echo "image_ref=${IMAGE_LATEST}" >> "$GITHUB_OUTPUT"
echo "image_versioned=${IMAGE_VERSIONED}" >> "$GITHUB_OUTPUT"
DIGEST=$(head -1 /tmp/image-refs.txt | sed 's/.*@//')
echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
@ -93,7 +153,7 @@ jobs:
jq -n \
--arg type "https://in-toto.io/Statement/v0.1" \
--arg predType "https://slsa.dev/provenance/v0.2" \
--arg name "${{ steps.publish.outputs.image_ref }}" \
--arg name "${{ steps.publish.outputs.image_versioned }}" \
--arg sha "$DIGEST_SHA" \
--arg builder "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
--arg buildType "https://apko.dev/build/v1" \

View File

@ -148,16 +148,68 @@ jobs:
username: ${{ secrets.REGISTRY_USERNAME }}
password: ${{ secrets.REGISTRY_PASSWORD }}
- name: Determine upstream version
id: version
run: |
VARIANT="${{ matrix.variant }}"
case "$VARIANT" in
base|build)
UPSTREAM=$(apko resolve ${{ matrix.config }} 2>&1 | grep -oP 'glibc-\K[0-9]+\.[0-9]+' | head -1 || echo "0.0")
if [ "$UPSTREAM" = "" ] || [ "$UPSTREAM" = "0.0" ]; then
UPSTREAM=$(apko resolve ${{ matrix.config }} 2>&1 | grep -oP 'glibc \(\K[0-9]+\.[0-9]+' | head -1 || echo "2.42")
fi
;;
dotnet-runtime)
UPSTREAM=$(curl -fsSL "https://dotnetcli.azureedge.net/dotnet/release-metadata/releases-index.json" \
| jq -r '[."releases-index"[] | select(."support-phase" == "active" or ."support-phase" == "go-live") | ."latest-runtime"] | sort_by(. | split(".") | map(tonumber)) | last')
;;
dotnet-sdk)
UPSTREAM=$(curl -fsSL "https://dotnetcli.azureedge.net/dotnet/release-metadata/releases-index.json" \
| jq -r '[."releases-index"[] | select(."support-phase" == "active" or ."support-phase" == "go-live") | ."latest-sdk"] | sort_by(. | split(".") | map(tonumber)) | last')
;;
flutter-sdk)
UPSTREAM=$(curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/releases_linux.json" \
| jq -r '.current_release.stable as $hash | .releases[] | select(.hash == $hash and .channel == "stable") | .version')
;;
esac
echo "upstream=${UPSTREAM}" >> "$GITHUB_OUTPUT"
echo "Upstream version for ${VARIANT}: ${UPSTREAM}"
REPO_NAME="${{ env.IMAGE_NAME }}"
REGISTRY_URL="${{ secrets.REGISTRY_URL }}"
NAMESPACE=$(echo "$REGISTRY_URL" | sed 's|.*://||; s|.*\.io/||; s|/$||')
EXISTING_TAGS=$(curl -s "https://hub.docker.com/v2/repositories/${NAMESPACE}/${REPO_NAME}/tags?page_size=100&name=${VARIANT}-${UPSTREAM}." \
| jq -r '.results[]?.name // empty' 2>/dev/null || echo "")
MAX_BUILD=0
for tag in $EXISTING_TAGS; do
BUILD_NUM=$(echo "$tag" | grep -oP "\.\K[0-9]+$" || echo "0")
if [ "$BUILD_NUM" -gt "$MAX_BUILD" ] 2>/dev/null; then
MAX_BUILD=$BUILD_NUM
fi
done
NEXT_BUILD=$((MAX_BUILD + 1))
VERSION_TAG="${VARIANT}-${UPSTREAM}.${NEXT_BUILD}"
echo "version_tag=${VERSION_TAG}" >> "$GITHUB_OUTPUT"
echo "Next version tag: ${VERSION_TAG}"
- name: Build and push image
id: publish
run: |
IMAGE_REF=${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-latest
IMAGE_LATEST=${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ matrix.variant }}-latest
IMAGE_VERSIONED=${{ secrets.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version_tag }}
mkdir -p /tmp/sbom
apko publish ${{ matrix.config }} \
--sbom-path /tmp/sbom \
--image-refs /tmp/image-refs.txt \
"${IMAGE_REF}"
echo "image_ref=${IMAGE_REF}" >> "$GITHUB_OUTPUT"
"${IMAGE_LATEST}" \
"${IMAGE_VERSIONED}"
echo "image_ref=${IMAGE_LATEST}" >> "$GITHUB_OUTPUT"
echo "image_versioned=${IMAGE_VERSIONED}" >> "$GITHUB_OUTPUT"
DIGEST=$(head -1 /tmp/image-refs.txt | sed 's/.*@//')
echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
@ -183,7 +235,7 @@ jobs:
jq -n \
--arg type "https://in-toto.io/Statement/v0.1" \
--arg predType "https://slsa.dev/provenance/v0.2" \
--arg name "${{ steps.publish.outputs.image_ref }}" \
--arg name "${{ steps.publish.outputs.image_versioned }}" \
--arg sha "$DIGEST_SHA" \
--arg builder "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
--arg buildType "https://apko.dev/build/v1" \