Initial minimal Flutter SDK image for web/WASM CI builds

- Dockerfile based on debian:bookworm-slim with web-only Flutter SDK - Release pipeline with Docker Scout CVE scan, SBOM, and provenance - Scout PR pipeline with check-image gate - Daily update-check pipeline that auto-creates releases for new Flutter stable versions via Gitea API Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-02 00:39:04 -05:00
commit 8d48dcc5fd
5 changed files with 246 additions and 0 deletions
@@ -0,0 +1,75 @@
+name: Build and Push Flutter SDK Image
+
+on:
+  release:
+    types: [published, prereleased]
+
+permissions:
+  contents: read
+
+env:
+  IMAGE_NAME: gpb-flutter-sdk-web
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Determine Tag Type
+        id: tag_type
+        run: |
+          if [[ "${{ github.event.release.prerelease }}" == "true" ]]; then
+            echo "tag=dev" >> $GITHUB_OUTPUT
+          else
+            echo "tag=latest" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Registry
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_SVRNTY_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_SVRNTY_ACCESS_TOKEN }}
+
+      - name: Build image for Scout analysis
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          platforms: linux/amd64
+          push: false
+          load: true
+          build-args: |
+            FLUTTER_VERSION=${{ github.event.release.tag_name }}
+          tags: ${{ vars.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.event.release.tag_name }}
+
+      - name: Install Docker Scout
+        run: |
+          curl -fsSL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh -o install-scout.sh
+          sh install-scout.sh
+
+      - name: Docker Scout CVE Scan
+        run: |
+          docker scout cves ${{ vars.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.event.release.tag_name }} --only-severity critical,high
+
+      - name: Build and push with attestations
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          platforms: linux/amd64
+          push: true
+          sbom: true
+          provenance: mode=max
+          build-args: |
+            FLUTTER_VERSION=${{ github.event.release.tag_name }}
+          tags: |
+            ${{ vars.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.event.release.tag_name }}
+            ${{ vars.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.tag_type.outputs.tag }}
+          labels: |
+            org.opencontainers.image.title=${{ env.IMAGE_NAME }}
+            org.opencontainers.image.description=Minimal Flutter SDK for Web/WASM CI builds
+            org.opencontainers.image.version=${{ github.event.release.tag_name }}
+            org.opencontainers.image.revision=${{ github.sha }}
@@ -0,0 +1,70 @@
+name: Docker Scout Analysis
+
+on:
+  pull_request:
+    branches: ["**"]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+env:
+  IMAGE_NAME: gpb-flutter-sdk-web
+
+jobs:
+  check-image:
+    runs-on: ubuntu-latest
+    outputs:
+      image_exists: ${{ steps.check.outputs.exists }}
+    steps:
+      - name: Log in to DockerHub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_SVRNTY_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_SVRNTY_ACCESS_TOKEN }}
+
+      - name: Check if latest image exists
+        id: check
+        run: |
+          if docker manifest inspect ${{ vars.REGISTRY }}/${{ env.IMAGE_NAME }}:latest > /dev/null 2>&1; then
+            echo "exists=true" >> $GITHUB_OUTPUT
+            echo "Latest image found, Scout compare will run"
+          else
+            echo "exists=false" >> $GITHUB_OUTPUT
+            echo "No latest image found, skipping Scout compare (nothing to compare against)"
+          fi
+
+  scout-amd64:
+    runs-on: ubuntu-latest
+    needs: check-image
+    if: needs.check-image.outputs.image_exists == 'true'
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to DockerHub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_SVRNTY_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_SVRNTY_ACCESS_TOKEN }}
+
+      - name: Build amd64 image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          platforms: linux/amd64
+          push: false
+          load: true
+          tags: ${{ vars.REGISTRY }}/${{ env.IMAGE_NAME }}:pr-${{ github.event.pull_request.number }}-amd64
+
+      - name: Install Docker Scout
+        run: |
+          curl -fsSL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh -o install-scout.sh
+          sh install-scout.sh
+
+      - name: Docker Scout Compare (amd64)
+        run: |
+          docker scout compare ${{ vars.REGISTRY }}/${{ env.IMAGE_NAME }}:pr-${{ github.event.pull_request.number }}-amd64 --to ${{ vars.REGISTRY }}/${{ env.IMAGE_NAME }}:latest --ignore-unchanged --only-severity critical,high
@@ -0,0 +1,49 @@
+name: Check for Flutter SDK Updates
+
+on:
+  schedule:
+    - cron: '0 8 * * *'
+  workflow_dispatch:
+
+jobs:
+  check-update:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Get latest Flutter stable version
+        id: flutter
+        run: |
+          LATEST=$(curl -fsSL https://storage.googleapis.com/flutter_infra_release/releases/releases_linux.json \
+            | jq -r '.current_release.stable as $hash | .releases[] | select(.hash == $hash) | .version')
+          echo "version=${LATEST}" >> $GITHUB_OUTPUT
+          echo "Latest Flutter stable: ${LATEST}"
+
+      - name: Check if release already exists
+        id: existing
+        run: |
+          VERSION="${{ steps.flutter.outputs.version }}"
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/tags/${VERSION}")
+          if [ "$STATUS" = "200" ]; then
+            echo "exists=true" >> $GITHUB_OUTPUT
+            echo "Release ${VERSION} already exists, skipping"
+          else
+            echo "exists=false" >> $GITHUB_OUTPUT
+            echo "Release ${VERSION} not found, will create"
+          fi
+
+      - name: Create release for new version
+        if: steps.existing.outputs.exists == 'false' && steps.flutter.outputs.version != ''
+        run: |
+          VERSION="${{ steps.flutter.outputs.version }}"
+          echo "Creating release for Flutter ${VERSION}"
+          curl -fsSL -X POST \
+            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases" \
+            -d "{
+              \"tag_name\": \"${VERSION}\",
+              \"name\": \"Flutter SDK ${VERSION}\",
+              \"body\": \"Automated release for Flutter stable ${VERSION}\",
+              \"draft\": false,
+              \"prerelease\": false
+            }"