feat(release): add verified GHCR image publication

2026-08-10 13:26:57 +09:00
parent 21f7e7de77
commit fe46f8b237
9 changed files with 1406 additions and 0 deletions
@@ -0,0 +1,128 @@
+name: Publish verified container image
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Check out exact source commit
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install repository checks
+        run: python -m pip install ".[dev]"
+
+      - name: Run repository lint
+        run: ruff check .
+
+      - name: Run repository tests
+        run: pytest
+
+      - name: Create excluded synthetic canary
+        run: |
+          python - <<'PY'
+          from pathlib import Path
+          Path(".env.ci-canary").write_text("TREX_SECRET_CANARY_DO_NOT_SHIP\n", encoding="ascii")
+          PY
+
+      - name: Build source image once
+        run: |
+          docker build \
+            --provenance=false \
+            --build-arg "SOURCE_COMMIT=${GITHUB_SHA}" \
+            --tag "trex-core-ci:${GITHUB_SHA}" \
+            .
+
+      - name: Smoke built image
+        run: python scripts/image_release.py smoke --image "trex-core-ci:${GITHUB_SHA}"
+
+      - name: Record tested image ID
+        run: |
+          python scripts/image_release.py record-image-id \
+            --image "trex-core-ci:${GITHUB_SHA}" \
+            --output trex-core-image.id
+
+      - name: Export tested image
+        run: docker save --output trex-core-image.tar "trex-core-ci:${GITHUB_SHA}"
+
+      - name: Scan all canary surfaces
+        run: |
+          set +e
+          python scripts/image_release.py scan \
+            --image "trex-core-ci:${GITHUB_SHA}" \
+            --archive trex-core-image.tar \
+            >canary-scan.stdout 2>canary-scan.stderr
+          scan_status=$?
+          set -e
+          python scripts/image_release.py assert-clean-output \
+            canary-scan.stdout canary-scan.stderr
+          exit "${scan_status}"
+
+      - name: Record tested archive checksum
+        run: |
+          python scripts/image_release.py checksum \
+            --archive trex-core-image.tar \
+            --output trex-core-image.tar.sha256
+
+      - name: Upload immutable tested image artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: tested-image-${{ github.run_id }}-${{ github.run_attempt }}
+          if-no-files-found: error
+          overwrite: false
+          retention-days: 7
+          path: |
+            trex-core-image.tar
+            trex-core-image.tar.sha256
+            trex-core-image.id
+            scripts/image_release.py
+
+  publish:
+    needs: verify
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    outputs:
+      image: ${{ steps.publish.outputs.image }}
+      digest: ${{ steps.publish.outputs.digest }}
+      source_commit: ${{ steps.publish.outputs.source_commit }}
+    steps:
+      - name: Download tested image artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: tested-image-${{ github.run_id }}-${{ github.run_attempt }}
+          path: tested-image
+
+      - name: Verify, load, and publish without rebuilding
+        id: publish
+        env:
+          GITHUB_ACTOR: ${{ github.actor }}
+          REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          python tested-image/image_release.py publish \
+            --archive tested-image/trex-core-image.tar \
+            --checksum tested-image/trex-core-image.tar.sha256 \
+            --image-id tested-image/trex-core-image.id \
+            --local-image "trex-core-ci:${GITHUB_SHA}" \
+            --commit "${GITHUB_SHA}" \
+            --ref "${GITHUB_REF}"