ci: Enable reproducible container builds

Requires to use the upcoming buildkit release 0.13.0 and a number of extra parameters to build-push-action. We also need to avoid layer caches during the initial builds as those may contain wrong timestamps (Buildkit issue). Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
siemens · Mar 4, 2024 · 2176945 · 2176945
1 parent c9bd1b6
commit 2176945
Show file tree

Hide file tree

Showing 4 changed files with 83 additions and 14 deletions.
diff --git a/.github/actions/docker-init/action.yml b/.github/actions/docker-init/action.yml
@@ -13,12 +13,24 @@ runs:
       uses: docker/setup-qemu-action@v3
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
+      with:
+        driver-opts: image=moby/buildkit:v0.13.0-rc3
     - name: Login to ghcr.io
       uses: docker/login-action@v3
       with:
         registry: ghcr.io
         username: ${{ inputs.deploy-user }}
         password: ${{ inputs.deploy-token }}
+    - name: Set SOURCE_DATE_EPOCH
+      run: |
+        echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
+      shell: bash
+    - name: Determine Debian tag
+      run: |
+        DEBIAN_RELEASE=$(grep -m 1 'ARG DEBIAN_TAG=' Dockerfile | sed 's/.*DEBIAN_TAG=\(.*\)-.*/\1/')
+        echo "DEBIAN_TAG=$(podman image search --list-tags debian --limit 1000000000 | \
+                           grep "$DEBIAN_RELEASE-.*-slim" | sort -r | head -1 | sed 's/.*[ ]\+//')" >> $GITHUB_ENV
+      shell: bash
     - name: Prepare repository for COPY-in
       run: |
         git clone . /home/runner/kas-clone

diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
@@ -32,15 +32,23 @@ jobs:
         if: ${{ env.PUSH_MASTER }}
         with:
           context: /home/runner/kas-clone
+          no-cache: true
           platforms: linux/amd64,linux/arm64
-          push: true
+          build-args: |
+            SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
+            DEBIAN_TAG=${{ env.DEBIAN_TAG }}
+          outputs: type=registry,rewrite-timestamp=true
           tags: ghcr.io/siemens/kas/kas
       - name: Build kas-isar image
         uses: docker/build-push-action@v5
         if: ${{ env.PUSH_MASTER }}
         with:
           context: /home/runner/kas-clone
+          no-cache: true
           target: kas-isar
           platforms: linux/amd64,linux/arm64
-          push: true
+          build-args: |
+            SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
+            DEBIAN_TAG=${{ env.DEBIAN_TAG }}
+          outputs: type=registry,rewrite-timestamp=true
           tags: ghcr.io/siemens/kas/kas-isar
diff --git a/.github/workflows/next.yml b/.github/workflows/next.yml
@@ -73,39 +73,80 @@ jobs:
         with:
           deploy-user: ${{ secrets.PACKAGE_DEPLOY_USER }}
           deploy-token: ${{ secrets.PACKAGE_DEPLOY_TOKEN }}
-      - name: Build kas image
+
+      - name: Build amd64 kas image
         uses: docker/build-push-action@v5
         with:
           context: /home/runner/kas-clone
-          load: true
+          no-cache: true
+          platforms: linux/amd64
+          build-args: |
+            SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
+            DEBIAN_TAG=${{ env.DEBIAN_TAG }}
+          outputs: type=docker,rewrite-timestamp=true
           tags: ghcr.io/siemens/kas/kas:next
       - name: Test kas image
         run: |
           cd image-tests/poky
           KAS_IMAGE_VERSION=next ../../kas-container build kas.yml
-      - name: Complete build and deploy kas image
+      - name: Deploy amd64 kas image
+        uses: docker/build-push-action@v5
+        with:
+          context: /home/runner/kas-clone
+          platforms: linux/amd64
+          build-args: |
+            SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
+            DEBIAN_TAG=${{ env.DEBIAN_TAG }}
+          outputs: type=registry,rewrite-timestamp=true
+          tags: ghcr.io/siemens/kas/kas:next
+      - name: Build and deploy arm64 kas image
         uses: docker/build-push-action@v5
         with:
           context: /home/runner/kas-clone
-          platforms: linux/amd64,linux/arm64
+          no-cache: true
+          platforms: linux/arm64
+          build-args: |
+            SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
+            DEBIAN_TAG=${{ env.DEBIAN_TAG }}
+          outputs: type=registry,rewrite-timestamp=true
           tags: ghcr.io/siemens/kas/kas:next
-          push: true
-      - name: Build kas-isar image
+
+      - name: Build amd64 kas-isar image
         uses: docker/build-push-action@v5
         with:
           context: /home/runner/kas-clone
+          no-cache: true
           target: kas-isar
-          load: true
+          platforms: linux/amd64
+          build-args: |
+            SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
+            DEBIAN_TAG=${{ env.DEBIAN_TAG }}
+          outputs: type=docker,rewrite-timestamp=true
           tags: ghcr.io/siemens/kas/kas-isar:next
       - name: Test kas-isar image
         run: |
           cd image-tests/isar
           KAS_IMAGE_VERSION=next ../../kas-container build kas.yml
-      - name: Complete build and deploy kas-isar image
+      - name: Deploy amd64 kas-isar image
+        uses: docker/build-push-action@v5
+        with:
+          context: /home/runner/kas-clone
+          target: kas-isar
+          platforms: linux/amd64
+          build-args: |
+            SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
+            DEBIAN_TAG=${{ env.DEBIAN_TAG }}
+          outputs: type=registry,rewrite-timestamp=true
+          tags: ghcr.io/siemens/kas/kas-isar:next
+      - name: Build and deploy arm64 kas-isar image
         uses: docker/build-push-action@v5
         with:
           context: /home/runner/kas-clone
+          no-cache: true
           target: kas-isar
-          platforms: linux/amd64,linux/arm64
+          platforms: linux/arm64
+          build-args: |
+            SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
+            DEBIAN_TAG=${{ env.DEBIAN_TAG }}
+          outputs: type=registry,rewrite-timestamp=true
           tags: ghcr.io/siemens/kas/kas-isar:next
-          push: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -23,8 +23,12 @@ jobs:
         uses: docker/build-push-action@v5
         with:
           context: /home/runner/kas-clone
+          no-cache: true
           platforms: linux/amd64,linux/arm64
-          push: true
+          build-args: |
+            SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
+            DEBIAN_TAG=${{ env.DEBIAN_TAG }}
+          outputs: type=registry,rewrite-timestamp=true
           tags: |
             ghcr.io/siemens/kas/kas
             ghcr.io/siemens/kas/kas:${{ env.RELEASE_VERSION }}
@@ -33,9 +37,13 @@ jobs:
         uses: docker/build-push-action@v5
         with:
           context: /home/runner/kas-clone
+          no-cache: true
           target: kas-isar
           platforms: linux/amd64,linux/arm64
-          push: true
+          build-args: |
+            SOURCE_DATE_EPOCH=${{ env.SOURCE_DATE_EPOCH }}
+            DEBIAN_TAG=${{ env.DEBIAN_TAG }}
+          outputs: type=registry,rewrite-timestamp=true
           tags: |
             ghcr.io/siemens/kas/kas-isar
             ghcr.io/siemens/kas/kas-isar:${{ env.RELEASE_VERSION }}