Bump version to 2.2.2 #109

Workflow file for this run

	# Builds and publishes the multi-arch Docker image
	#
	# Triggered by:
	# - On git tag push, publishes to :X.Y.Z, :X.Y, :X.x and :latest
	# - On manual trigger, rebuilds the current branch as :latest, or a given tag
	# - On weekly cron, rebuilds the newest release as :latest, for base image patches
	#
	# The workflow will:
	# - Resolve and validate the version up front, so bad input fails in seconds
	# - Build multi-arch (amd64, arm64) in parallel on native runners (no QEMU)
	# - Trivy scans + reports security issues, and fails cron on CRITICAL CVEs
	# - Publishes to GHCR, then to Docker Hub if configured (never blocking GHCR)
	# - Attaches BuildKit per-arch SBOM + provenance to the image itself
	# - Signs provenance (index) and per-arch SBOMs (per-arch manifest) via Sigstore
	# - Writes a pretty job summary with tags, digest and attestation status

	name: 🐳 Docker Publish

	on:
	workflow_dispatch:
	inputs:
	tag:
	description: 'Tag to build (empty = build current ref as :latest. tag must exist in git)'
	required: false
	default: ''
	push:
	# Trigger on new tags (which are created after each merge)
	tags: ['..*']
	schedule:
	- cron: '0 4 * * 0'

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}-${{ inputs.tag }}
	cancel-in-progress: false

	permissions:
	contents: read # least-privilege default; jobs elevate as needed

	env:
	GH_IMAGE: ghcr.io/${{ github.repository }}
	DH_IMAGE: docker.io/${{ vars.DOCKER_REPO \|\| 'lissy93/web-check' }}

	jobs:
	prepare:
	name: 🔢 Resolve Version
	timeout-minutes: 5
	runs-on: ubuntu-latest
	outputs:
	ref: ${{ steps.resolve.outputs.ref }}
	version: ${{ steps.resolve.outputs.version }}
	semver: ${{ steps.resolve.outputs.semver }}
	latest: ${{ steps.resolve.outputs.latest }}
	steps:
	- name: 🛎️ Checkout (with tags)
	uses: actions/checkout@v6
	with:
	fetch-depth: 0

	- name: 🔢 Resolve & validate version
	id: resolve
	env:
	INPUT_TAG: ${{ inputs.tag }}
	EVENT: ${{ github.event_name }}
	REF_NAME: ${{ github.ref_name }}
	REF_TYPE: ${{ github.ref_type }}
	run: \|
	set -euo pipefail
	SEMVER='^[0-9]+\.[0-9]+\.[0-9]+$'

	if [ -n "$INPUT_TAG" ]; then
	# Manual rebuild of a specific release - validate before doing any work
	if ! echo "$INPUT_TAG" \| grep -qE "$SEMVER"; then
	echo "::error::Invalid tag '${INPUT_TAG}'. Must be semver (e.g. 2.2.0)."
	exit 1
	fi
	if ! git rev-parse -q --verify "refs/tags/${INPUT_TAG}" >/dev/null; then
	echo "::error::Tag '${INPUT_TAG}' does not exist in this repository."
	exit 1
	fi
	# Rebuilding an older release must never move :latest
	ref="refs/tags/${INPUT_TAG}"; version="$INPUT_TAG"; semver=true; latest=false

	elif [ "$REF_TYPE" = "tag" ]; then
	# A release tag was pushed (by 🔖 Auto Version & Tag, or by hand)
	if ! echo "$REF_NAME" \| grep -qE "$SEMVER"; then
	echo "::error::Tag '${REF_NAME}' is not semver; refusing to publish."
	exit 1
	fi
	ref="refs/tags/${REF_NAME}"; version="$REF_NAME"; semver=true; latest=true

	elif [ "$EVENT" = "schedule" ]; then
	# Weekly refresh. Rebuild the newest release rather than master, so
	# :latest picks up base image patches without drifting onto unreleased
	# code. semver=false keeps already-published version tags immutable
	newest=$(git tag --list --sort=-v:refname \| grep -E "$SEMVER" \| head -n1 \|\| true)
	if [ -z "$newest" ]; then
	echo "::error::No semver tag found to rebuild."
	exit 1
	fi
	ref="refs/tags/${newest}"; version="$newest"; semver=false; latest=true

	else
	# Manual build of whatever ref was dispatched
	ref="$GITHUB_REF"; version="latest"; semver=false; latest=true
	fi

	echo "Building ${ref} as version=${version} (semver=${semver}, latest=${latest})"
	{
	echo "ref=$ref"
	echo "version=$version"
	echo "semver=$semver"
	echo "latest=$latest"
	} >> "$GITHUB_OUTPUT"

	build:
	name: 🔨 Build (${{ matrix.arch }})
	needs: prepare
	timeout-minutes: 60
	permissions:
	contents: read # for checkout
	packages: write # for push image by digest to GHCR
	security-events: write # for upload Trivy SARIF to code scanning
	env:
	DOCKER_BUILD_SUMMARY: 'false'
	DOCKER_BUILD_RECORD_UPLOAD: 'false'
	strategy:
	fail-fast: false
	matrix:
	include:
	- platform: linux/amd64
	runner: ubuntu-latest
	arch: amd64
	- platform: linux/arm64
	runner: ubuntu-24.04-arm
	arch: arm64
	runs-on: ${{ matrix.runner }}
	steps:
	- name: 🛎️ Checkout
	uses: actions/checkout@v6
	with:
	ref: ${{ needs.prepare.outputs.ref }}

	- name: 🏷️ Build metadata
	id: meta
	run: \|
	set -euo pipefail
	{
	echo "revision=$(git rev-parse HEAD)"
	echo "created=$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
	} >> "$GITHUB_OUTPUT"

	- name: 🔧 Set up Buildx
	uses: docker/setup-buildx-action@v4

	- name: 🔑 Login to GHCR
	uses: docker/login-action@v4
	with:
	registry: ghcr.io
	username: ${{ github.repository_owner }}
	password: ${{ secrets.GITHUB_TOKEN }}

	# Attestations can't go through the docker exporter, so this scan-only
	# build sets provenance: false. The push below re-adds them.
	- name: 🔨 Build image (load for scan)
	uses: docker/build-push-action@v7
	with:
	context: .
	file: ./Dockerfile
	platforms: ${{ matrix.platform }}
	load: true
	tags: web-check-scan:${{ matrix.arch }}
	provenance: false

	# Only the weekly cron treats CVEs as fatal. Everywhere else the scan is
	# advisory, so a Trivy or DB outage can never block a release
	- name: 🛡️ Trivy vulnerability scan
	id: scan
	uses: aquasecurity/trivy-action@v0.36.0
	continue-on-error: ${{ github.event_name != 'schedule' }}
	env:
	TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db:2
	TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db:1
	with:
	image-ref: web-check-scan:${{ matrix.arch }}
	severity: CRITICAL
	ignore-unfixed: true
	exit-code: ${{ github.event_name == 'schedule' && '1' \|\| '0' }}
	vuln-type: 'os,library'
	format: 'sarif'
	output: 'trivy-${{ matrix.arch }}.sarif'
	timeout: '10m'

	# If CVEs blocked the build, print them so they're readable in the log
	- name: 📋 List blocking CVEs (on scan failure)
	if: always() && steps.scan.outcome == 'failure'
	continue-on-error: true
	run: \|
	jq -r '.runs[].results[]? \| "\(.ruleId): \(.message.text)"' \
	"trivy-${{ matrix.arch }}.sarif" \| sort -u

	- name: 📤 Upload Trivy SARIF
	if: always() && hashFiles(format('trivy-{0}.sarif', matrix.arch)) != ''
	continue-on-error: true
	uses: github/codeql-action/upload-sarif@v4
	with:
	sarif_file: trivy-${{ matrix.arch }}.sarif
	category: trivy-${{ matrix.arch }}

	- name: 🚀 Push by digest
	id: push
	uses: docker/build-push-action@v7
	with:
	context: .
	file: ./Dockerfile
	platforms: ${{ matrix.platform }}
	provenance: mode=max
	sbom: true
	labels: \|
	org.opencontainers.image.version=${{ needs.prepare.outputs.version }}
	org.opencontainers.image.revision=${{ steps.meta.outputs.revision }}
	org.opencontainers.image.created=${{ steps.meta.outputs.created }}
	outputs: type=image,name=${{ env.GH_IMAGE }},push-by-digest=true,name-canonical=true,push=true

	- name: 🧬 Write digest
	env:
	DIGEST: ${{ steps.push.outputs.digest }}
	DIGESTS_DIR: ${{ runner.temp }}/digests
	ARCH: ${{ matrix.arch }}
	run: \|
	set -euo pipefail
	if [ -z "$DIGEST" ]; then
	echo "::error::Build produced no digest for ${ARCH}"
	exit 1
	fi
	mkdir -p "$DIGESTS_DIR"
	echo "$DIGEST" > "$DIGESTS_DIR/$ARCH"

	- name: 📤 Upload digest
	uses: actions/upload-artifact@v7
	with:
	name: digest-${{ matrix.arch }}
	path: ${{ runner.temp }}/digests/${{ matrix.arch }}
	if-no-files-found: error
	retention-days: 1

	merge:
	name: 🧩 Merge & Push Manifests
	needs: [prepare, build]
	timeout-minutes: 45
	runs-on: ubuntu-latest
	permissions:
	contents: read # least-privilege baseline
	packages: write # push manifest + attestations to GHCR
	id-token: write # OIDC token for keyless attestation signing
	attestations: write # write provenance + SBOM attestations
	artifact-metadata: write # storage record for push-to-registry
	env:
	HAS_DH: ${{ secrets.DOCKERHUB_PASSWORD != '' }}
	steps:
	- name: 📥 Download digests
	uses: actions/download-artifact@v8
	with:
	path: ${{ runner.temp }}/digests
	pattern: digest-*
	merge-multiple: true

	- name: 🔧 Set up Buildx
	uses: docker/setup-buildx-action@v4

	- name: 🔑 Login to GHCR
	uses: docker/login-action@v4
	with:
	registry: ghcr.io
	username: ${{ github.repository_owner }}
	password: ${{ secrets.GITHUB_TOKEN }}

	- name: 🔑 Login to Docker Hub
	id: dh_login
	if: env.HAS_DH == 'true'
	continue-on-error: true
	uses: docker/login-action@v4
	with:
	username: ${{ vars.DOCKER_USERNAME \|\| 'lissy93' }}
	password: ${{ secrets.DOCKERHUB_PASSWORD }}

	# Builds race: a newer release tagged while this one was building must not
	# be clobbered by an older build finishing second
	- name: 🕓 Guard against :latest regression
	id: guard
	env:
	VERSION: ${{ needs.prepare.outputs.version }}
	WANT_LATEST: ${{ needs.prepare.outputs.latest }}
	GH_TOKEN: ${{ github.token }}
	run: \|
	set -euo pipefail
	keep="$WANT_LATEST"
	if [ "$WANT_LATEST" = "true" ] && [ "$VERSION" != "latest" ]; then
	newest=$(gh api "repos/${GITHUB_REPOSITORY}/tags" --paginate -q '.[].name' 2>/dev/null \
	\| grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' \| sort -V \| tail -n1 \|\| true)
	if [ -n "$newest" ] && [ "$newest" != "$VERSION" ] &&
	[ "$(printf '%s\n%s\n' "$VERSION" "$newest" \| sort -V \| tail -n1)" = "$newest" ]; then
	echo "::warning::Release ${newest} is newer than ${VERSION}; not moving :latest"
	keep=false
	fi
	fi
	echo "latest=$keep" >> "$GITHUB_OUTPUT"

	- name: 🗂️ Generate tags
	id: meta
	uses: docker/metadata-action@v6
	with:
	images: \|
	${{ env.GH_IMAGE }}
	${{ steps.dh_login.outcome == 'success' && env.DH_IMAGE \|\| '' }}
	tags: \|
	type=raw,value=latest,enable=${{ steps.guard.outputs.latest }}
	type=semver,pattern={{version}},value=${{ needs.prepare.outputs.version }},enable=${{ needs.prepare.outputs.semver }}
	type=semver,pattern={{major}}.{{minor}},value=${{ needs.prepare.outputs.version }},enable=${{ needs.prepare.outputs.semver }}
	type=semver,pattern={{major}}.x,value=${{ needs.prepare.outputs.version }},enable=${{ needs.prepare.outputs.semver }}
	flavor: \|
	latest=false

	# GHCR PUSH
	- name: 🧩 Create & push manifest (GHCR)
	id: manifest
	working-directory: ${{ runner.temp }}/digests
	run: \|
	set -euo pipefail
	shopt -s nullglob
	SOURCES=()
	for f in *; do SOURCES+=("${GH_IMAGE}@$(cat "$f")"); done
	if [ ${#SOURCES[@]} -eq 0 ]; then
	echo "::error::No per-arch digests found"
	exit 1
	fi
	mapfile -t TAGS < <(jq -r --arg img "$GH_IMAGE" \
	'.tags[] \| select(startswith($img + ":"))' <<< "$DOCKER_METADATA_OUTPUT_JSON")
	if [ ${#TAGS[@]} -eq 0 ]; then
	echo "::error::No GHCR tags were generated"
	exit 1
	fi
	ARGS=(); for t in "${TAGS[@]}"; do ARGS+=(-t "$t"); done
	docker buildx imagetools create "${ARGS[@]}" "${SOURCES[@]}"
	DIGEST=$(docker buildx imagetools inspect "${TAGS[0]}" --format '{{.Manifest.Digest}}')
	echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
	echo "Published ${#TAGS[@]} tag(s) to GHCR at ${DIGEST}"

	- name: 🧩 Create & push manifest (Docker Hub)
	id: dh_manifest
	if: steps.dh_login.outcome == 'success'
	continue-on-error: true
	working-directory: ${{ runner.temp }}/digests
	env:
	GHCR_DIGEST: ${{ steps.manifest.outputs.digest }}
	run: \|
	set -euo pipefail
	shopt -s nullglob
	SOURCES=()
	for f in *; do SOURCES+=("${GH_IMAGE}@$(cat "$f")"); done
	if [ ${#SOURCES[@]} -eq 0 ]; then
	echo "::error::No per-arch digests found"
	exit 1
	fi
	mapfile -t TAGS < <(jq -r --arg img "$DH_IMAGE" \
	'.tags[] \| select(startswith($img + ":"))' <<< "$DOCKER_METADATA_OUTPUT_JSON")
	if [ ${#TAGS[@]} -eq 0 ]; then
	echo "::error::No Docker Hub tags were generated"
	exit 1
	fi
	ARGS=(); for t in "${TAGS[@]}"; do ARGS+=(-t "$t"); done
	docker buildx imagetools create "${ARGS[@]}" "${SOURCES[@]}"
	DIGEST=$(docker buildx imagetools inspect "${TAGS[0]}" --format '{{.Manifest.Digest}}')
	# Same source descriptors must yield the same index; if not, the
	# attestations below would be signing the wrong thing
	if [ "$DIGEST" != "$GHCR_DIGEST" ]; then
	echo "::error::Docker Hub digest ${DIGEST} != GHCR ${GHCR_DIGEST}; skipping its attestations"
	exit 1
	fi
	echo "Published ${#TAGS[@]} tag(s) to Docker Hub at ${DIGEST}"

	# BuildKit writes a each SBOM per architecture
	- name: 🧾 Extract per-arch SBOMs & subjects
	id: sbom
	env:
	DIGEST: ${{ steps.manifest.outputs.digest }}
	run: \|
	set -euo pipefail
	RAW=$(docker buildx imagetools inspect "${GH_IMAGE}@${DIGEST}" --raw)
	for arch in amd64 arm64; do
	subject=$(jq -r --arg a "$arch" \
	'[.manifests[] \| select(.platform.os == "linux" and .platform.architecture == $a) \| .digest] \| first // empty' \
	<<< "$RAW")
	fmt='{{ json (index .SBOM "linux/'"$arch"'").SPDX }}'
	docker buildx imagetools inspect "${GH_IMAGE}@${DIGEST}" \
	--format "$fmt" > "sbom.$arch.json" 2>/dev/null \|\| true
	if [ -n "$subject" ] && jq -e 'type == "object" and has("packages")' "sbom.$arch.json" >/dev/null 2>&1; then
	echo "${arch}=true" >> "$GITHUB_OUTPUT"
	echo "${arch}_subject=$subject" >> "$GITHUB_OUTPUT"
	echo "linux/${arch}: $(jq '.packages \| length' "sbom.$arch.json") packages -> ${subject}"
	else
	echo "::warning::No SBOM or subject for linux/${arch}; skipping its attestation"
	echo "${arch}=false" >> "$GITHUB_OUTPUT"
	fi
	done

	- name: 🛡️ Attest provenance (GHCR)
	id: prov_ghcr
	uses: actions/attest@v4
	continue-on-error: true
	with:
	subject-name: ${{ env.GH_IMAGE }}
	subject-digest: ${{ steps.manifest.outputs.digest }}
	push-to-registry: true
	show-summary: false

	- name: 🪪 Attest SBOM, amd64 (GHCR)
	id: sbom_amd64_ghcr
	if: steps.sbom.outputs.amd64 == 'true'
	uses: actions/attest@v4
	continue-on-error: true
	with:
	subject-name: ${{ env.GH_IMAGE }}
	subject-digest: ${{ steps.sbom.outputs.amd64_subject }}
	sbom-path: sbom.amd64.json
	push-to-registry: true
	show-summary: false

	- name: 🪪 Attest SBOM, arm64 (GHCR)
	id: sbom_arm64_ghcr
	if: steps.sbom.outputs.arm64 == 'true'
	uses: actions/attest@v4
	continue-on-error: true
	with:
	subject-name: ${{ env.GH_IMAGE }}
	subject-digest: ${{ steps.sbom.outputs.arm64_subject }}
	sbom-path: sbom.arm64.json
	push-to-registry: true
	show-summary: false

	- name: 🛡️ Attest provenance (Docker Hub)
	id: prov_dh
	if: steps.dh_manifest.outcome == 'success'
	uses: actions/attest@v4
	continue-on-error: true
	with:
	subject-name: ${{ env.DH_IMAGE }}
	subject-digest: ${{ steps.manifest.outputs.digest }}
	push-to-registry: true
	show-summary: false

	- name: 🪪 Attest SBOM, amd64 (Docker Hub)
	id: sbom_amd64_dh
	if: steps.dh_manifest.outcome == 'success' && steps.sbom.outputs.amd64 == 'true'
	uses: actions/attest@v4
	continue-on-error: true
	with:
	subject-name: ${{ env.DH_IMAGE }}
	subject-digest: ${{ steps.sbom.outputs.amd64_subject }}
	sbom-path: sbom.amd64.json
	push-to-registry: true
	show-summary: false

	- name: 🪪 Attest SBOM, arm64 (Docker Hub)
	id: sbom_arm64_dh
	if: steps.dh_manifest.outcome == 'success' && steps.sbom.outputs.arm64 == 'true'
	uses: actions/attest@v4
	continue-on-error: true
	with:
	subject-name: ${{ env.DH_IMAGE }}
	subject-digest: ${{ steps.sbom.outputs.arm64_subject }}
	sbom-path: sbom.arm64.json
	push-to-registry: true
	show-summary: false

	- name: 📋 Job summary
	if: always()
	continue-on-error: true
	env:
	DIGEST: ${{ steps.manifest.outputs.digest }}
	TAGS_JSON: ${{ steps.meta.outputs.json }}
	DH_MANIFEST: ${{ steps.dh_manifest.outcome }}
	AMD64_SUBJECT: ${{ steps.sbom.outputs.amd64_subject }}
	ARM64_SUBJECT: ${{ steps.sbom.outputs.arm64_subject }}
	RESULTS: \|
	Provenance (GHCR)=${{ steps.prov_ghcr.outcome }}
	SBOM amd64 (GHCR)=${{ steps.sbom_amd64_ghcr.outcome }}
	SBOM arm64 (GHCR)=${{ steps.sbom_arm64_ghcr.outcome }}
	Provenance (Docker Hub)=${{ steps.prov_dh.outcome }}
	SBOM amd64 (Docker Hub)=${{ steps.sbom_amd64_dh.outcome }}
	SBOM arm64 (Docker Hub)=${{ steps.sbom_arm64_dh.outcome }}
	run: \|
	set -euo pipefail
	icon() {
	case "$1" in
	success) echo "✅" ;;
	failure) echo "⚠️" ;;
	*) echo "⏭️" ;;
	esac
	}
	{
	echo "## 🐳 Docker Image"
	echo
	echo "Manifest: \`${DIGEST:-unknown}\`"
	if [ "${DH_MANIFEST:-skipped}" = "failure" ]; then
	echo
	echo "> ⚠️ Docker Hub publish failed — GHCR was published successfully."
	fi
	echo
	echo "The following tags have been updated and published:"
	echo
	echo '```'
	if [ -n "${TAGS_JSON:-}" ]; then jq -r '.tags[]?' <<< "$TAGS_JSON"; fi
	echo '```'
	echo
	echo "## 🪪 Attestations"
	echo
	while IFS='=' read -r name outcome; do
	if [ -n "$name" ]; then
	echo "- $(icon "${outcome:-skipped}") ${name} — ${outcome:-skipped}"
	fi
	done <<< "${RESULTS:-}"
	echo
	echo "Attestation failures are non-fatal; the image is published regardless."
	echo
	echo "Verify provenance (subject is the multi-arch index):"
	echo '```bash'
	echo "gh attestation verify oci://${GH_IMAGE}@${DIGEST:-} --repo ${GITHUB_REPOSITORY}"
	echo '```'
	echo
	echo "Verify an SBOM (subject is the per-arch manifest, as BuildKit does):"
	echo '```bash'
	echo "gh attestation verify oci://${GH_IMAGE}@${AMD64_SUBJECT:-<amd64-digest>} --repo ${GITHUB_REPOSITORY} # amd64"
	echo "gh attestation verify oci://${GH_IMAGE}@${ARM64_SUBJECT:-<arm64-digest>} --repo ${GITHUB_REPOSITORY} # arm64"
	echo '```'
	} >> "$GITHUB_STEP_SUMMARY"

Navigation Menu

Uh oh!

Bump version to 2.2.2 #109

Workflow file

Bump version to 2.2.2 #109

Uh oh!

Workflow file for this run