Merge pull request #31 from docker/docker-release

Add release workflow

.github/release-drafter-config.yml

@@ -0,0 +1,62 @@
+name-template: "v$RESOLVED_VERSION"
+tag-template: "v$RESOLVED_VERSION"
+categories:
+  - title: "🚀 Features"
+    labels:
+      - "feat"
+      - "feature"
+      - "enhancement"
+  - title: "🐛 Bug Fixes"
+    labels:
+      - "fix"
+      - "bugfix"
+      - "bug"
+  - title: "🧰 Maintenance"
+    labels:
+      - "chore"
+
+change-template: "- $TITLE @$AUTHOR (#$NUMBER)"
+change-title-escapes: '\<*_&' # You can add # and @ to disable mentions, and add ` to disable code blocks.
+version-resolver:
+  major:
+    labels:
+      - "major"
+  minor:
+    labels:
+      - "minor"
+  patch:
+    labels:
+      - "patch"
+  default: patch
+template: |
+  ## Changes
+
+  $CHANGES
+
+autolabeler:
+  - label: "chore"
+    files:
+      - "*.md"
+    branch:
+      - '/docs{0,1}\/.+/'
+      - '/tests{0,1}\/.+/'
+      - '/chore{0,1}\/.+/'
+    title:
+      - "/docs/i"
+      - "/test/i"
+      - "/chore/i"
+  - label: "bug"
+    branch:
+      - '/fix\/.+/'
+      - '/revert\/.+/'
+    title:
+      - "/fix/i"
+      - "/revert/i"
+  - label: "feature"
+    branch:
+      - '/feature\/.+/'
+      - '/feat\/.+/'
+      - '/add\/.+/'
+    title:
+      - "/feat/i"
+      - "/add/i"

.github/workflows/release-drafter.yml

@@ -0,0 +1,23 @@
+name: Release Drafter
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types: [opened, reopened, synchronize]
+permissions:
+  contents: read
+
+jobs:
+  update_release_draft:
+    permissions:
+      contents: write
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: release-drafter/release-drafter@v6
+        with:
+          config-name: release-drafter-config.yml
+          publish: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -0,0 +1,56 @@
+name: release
+on:
+  release:
+    types: [published]
+env:
+  IMAGE_NAME: docker/attest-provider
+jobs:
+  dockerhub:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: dockerpublicbot
+          password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
+      - name: Generate GitHub App Token
+        id: app-token
+        uses: actions/create-github-app-token@ad38cffc07bac6e3857755914c4c88bfd2db4da4 # v1.10.2
+        with:
+          app-id: ${{ vars.APP_ID }}
+          private-key: ${{ secrets.DOCKER_READ_APP_PRIVATE_KEY }}
+          repositories: "attest,attest-provider"
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ env.IMAGE_NAME }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=sha
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          version: lab:latest
+          driver: cloud
+          endpoint: docker/default
+          install: true
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          target: production
+          build-args: |
+            VERSION=v${{ steps.meta.outputs.version }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          platforms: linux/amd64,linux/arm64 # todo figure out additional platforms for release
+          attests: type=sbom,generator=docker/scout-sbom-indexer:1
+          provenance: mode=max
+          secrets: |
+            GITHUB_TOKEN=${{ steps.app-token.outputs.token }}

Dockerfile

@@ -1,38 +1,37 @@
 ARG BUILDERIMAGE="golang:1.22"
 ARG BASEIMAGE="gcr.io/distroless/static:nonroot"
 
-FROM ${BUILDERIMAGE} as builder
+FROM ${BUILDERIMAGE} AS builder
 
-ARG LDFLAGS
-
-ENV GO111MODULE=on \
-  CGO_ENABLED=0
+ENV CGO_ENABLED=0
 
 WORKDIR /app
 
-COPY . .
-
-# --- This block can be replaced by `RUN go mod download` when github.com/docker/attest is public
+# --- This block can be removed when github.com/docker/attest is public
 ENV GOPRIVATE="github.com/docker/attest"
-RUN --mount=type=cache,target=$GOPATH/pkg/mod --mount=type=secret,id=GITHUB_TOKEN <<EOT
+RUN --mount=type=secret,id=GITHUB_TOKEN <<EOT
   set -e
   GITHUB_TOKEN=${GITHUB_TOKEN:-$(cat /run/secrets/GITHUB_TOKEN)}
   if [ -n "$GITHUB_TOKEN" ]; then
     echo "Setting GitHub access token"
     git config --global "url.https://x-access-token:${GITHUB_TOKEN}@github.com.insteadof" "https://github.com"
   fi
-  go mod download
 EOT
 # ---
 
-RUN --mount=type=cache,target=$GOPATH/pkg/mod --mount=type=cache,target=/root/.cache/go-build make build
+RUN --mount=type=bind,source=.,target=/app \
+    --mount=type=cache,target=$GOPATH/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    go build -o /bin/attest main.go
 
-FROM ${BASEIMAGE}
+FROM ${BASEIMAGE} AS production
 
-COPY --from=builder /app/bin/attest /
-
-COPY --from=builder --chown=65532:65532 /app/certs/tls.crt /app/certs/tls.key /certs/
+COPY --from=builder /bin/attest /
 
 USER 65532:65532
 
 ENTRYPOINT ["/attest"]
+
+FROM production AS dev
+
+COPY --chown=65532:65532 certs/tls.crt certs/tls.key /certs/