Skip to content

Commit 650c05d

Browse files
author
Wogan May
committed
Adding develop and deploy containers
1 parent b648958 commit 650c05d

File tree

16 files changed

+350
-8
lines changed

16 files changed

+350
-8
lines changed

‎.github/workflows/build.yml‎ renamed to ‎.github/workflows/deploy-build.yml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,15 @@
1-
name: Build Runtime
1+
name: Build Deploy Runtime
22

33
on:
44
push:
55
branches: [ "main" ]
6-
tags: [ 'v*.*' ]
76
pull_request:
87
branches: [ "main" ]
98

109
env:
1110
REGISTRY: ghcr.io
1211
IMAGE_NAME: ${{ github.repository }}
1312

14-
1513
jobs:
1614
build:
1715

@@ -70,7 +68,7 @@ jobs:
7068
id: build-and-push
7169
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
7270
with:
73-
context: .
71+
context: ./deploy
7472
push: ${{ github.event_name != 'pull_request' }}
7573
tags: |
7674
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest

‎.github/workflows/deploy-release.yml‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
name: Release Runtime
2+
3+
on:
4+
release:
5+
types:
6+
- released
7+
8+
env:
9+
REGISTRY: ghcr.io
10+
IMAGE_NAME: ${{ github.repository }}
11+
12+
jobs:
13+
build:
14+
15+
runs-on: ubuntu-latest
16+
permissions:
17+
contents: read
18+
packages: write
19+
# This is used to complete the identity challenge
20+
# with sigstore/fulcio when running outside of PRs.
21+
id-token: write
22+
23+
steps:
24+
- name: Checkout repository
25+
uses: actions/checkout@v4
26+
27+
- name: Set build variables
28+
id: build_vars
29+
run: |
30+
echo "IMAGE_NAME=${IMAGE_NAME,,}" >> $GITHUB_ENV
31+
32+
# Install the cosign tool except on PR
33+
# https://github.com/sigstore/cosign-installer
34+
- name: Install cosign
35+
if: github.event_name != 'pull_request'
36+
uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
37+
with:
38+
cosign-release: 'v2.2.4'
39+
40+
# Set up BuildKit Docker container builder to be able to build
41+
# multi-platform images and export cache
42+
# https://github.com/docker/setup-buildx-action
43+
- name: Set up Docker Buildx
44+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
45+
46+
# Login against a Docker registry except on PR
47+
# https://github.com/docker/login-action
48+
- name: Log into registry ${{ env.REGISTRY }}
49+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
50+
with:
51+
registry: ${{ env.REGISTRY }}
52+
username: ${{ github.actor }}
53+
password: ${{ secrets.GITHUB_TOKEN }}
54+
55+
# Extract metadata (tags, labels) for Docker
56+
# https://github.com/docker/metadata-action
57+
- name: Extract Docker metadata
58+
id: meta
59+
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
60+
with:
61+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
62+
63+
# Build and push Docker image with Buildx (don't push on PR)
64+
# https://github.com/docker/build-push-action
65+
- name: Build and push Docker image
66+
id: build-and-push
67+
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
68+
with:
69+
context: ./deploy
70+
push: true
71+
tags: |
72+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
73+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}
74+
labels: ${{ steps.meta.outputs.labels }}
75+
cache-from: type=gha
76+
cache-to: type=gha,mode=max
77+
78+
# Sign the resulting Docker image digest except on PRs.
79+
# This will only write to the public Rekor transparency log when the Docker
80+
# repository is public to avoid leaking data. If you would like to publish
81+
# transparency data even for private images, pass --force to cosign below.
82+
# https://github.com/sigstore/cosign
83+
- name: Sign the published Docker image
84+
env:
85+
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
86+
TAGS: ${{ steps.meta.outputs.tags }}
87+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
88+
# This step uses the identity token to provision an ephemeral certificate
89+
# against the sigstore community Fulcio instance.
90+
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎.github/workflows/develop-build.yml‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
name: Build Deploy Runtime
2+
3+
on:
4+
push:
5+
branches: [ "main" ]
6+
pull_request:
7+
branches: [ "main" ]
8+
9+
env:
10+
REGISTRY: ghcr.io
11+
IMAGE_NAME: ${{ github.repository }}
12+
13+
jobs:
14+
build:
15+
16+
runs-on: ubuntu-latest
17+
permissions:
18+
contents: read
19+
packages: write
20+
# This is used to complete the identity challenge
21+
# with sigstore/fulcio when running outside of PRs.
22+
id-token: write
23+
24+
steps:
25+
- name: Checkout repository
26+
uses: actions/checkout@v4
27+
28+
- name: Set build variables
29+
id: build_vars
30+
run: |
31+
echo "IMAGE_NAME=${IMAGE_NAME,,}" >> $GITHUB_ENV
32+
33+
# Install the cosign tool except on PR
34+
# https://github.com/sigstore/cosign-installer
35+
- name: Install cosign
36+
if: github.event_name != 'pull_request'
37+
uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
38+
with:
39+
cosign-release: 'v2.2.4'
40+
41+
# Set up BuildKit Docker container builder to be able to build
42+
# multi-platform images and export cache
43+
# https://github.com/docker/setup-buildx-action
44+
- name: Set up Docker Buildx
45+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
46+
47+
# Login against a Docker registry except on PR
48+
# https://github.com/docker/login-action
49+
- name: Log into registry ${{ env.REGISTRY }}
50+
if: github.event_name != 'pull_request'
51+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
52+
with:
53+
registry: ${{ env.REGISTRY }}
54+
username: ${{ github.actor }}
55+
password: ${{ secrets.GITHUB_TOKEN }}
56+
57+
# Extract metadata (tags, labels) for Docker
58+
# https://github.com/docker/metadata-action
59+
- name: Extract Docker metadata
60+
id: meta
61+
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
62+
with:
63+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
64+
65+
# Build and push Docker image with Buildx (don't push on PR)
66+
# https://github.com/docker/build-push-action
67+
- name: Build and push Docker image
68+
id: build-and-push
69+
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
70+
with:
71+
context: ./develop
72+
push: ${{ github.event_name != 'pull_request' }}
73+
tags: |
74+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
75+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}
76+
labels: ${{ steps.meta.outputs.labels }}
77+
cache-from: type=gha
78+
cache-to: type=gha,mode=max
79+
80+
# Sign the resulting Docker image digest except on PRs.
81+
# This will only write to the public Rekor transparency log when the Docker
82+
# repository is public to avoid leaking data. If you would like to publish
83+
# transparency data even for private images, pass --force to cosign below.
84+
# https://github.com/sigstore/cosign
85+
- name: Sign the published Docker image
86+
if: ${{ github.event_name != 'pull_request' }}
87+
env:
88+
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
89+
TAGS: ${{ steps.meta.outputs.tags }}
90+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
91+
# This step uses the identity token to provision an ephemeral certificate
92+
# against the sigstore community Fulcio instance.
93+
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎.github/workflows/develop-release.yml‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
name: Release Runtime
2+
3+
on:
4+
release:
5+
types:
6+
- released
7+
8+
env:
9+
REGISTRY: ghcr.io
10+
IMAGE_NAME: ${{ github.repository }}
11+
12+
jobs:
13+
build:
14+
15+
runs-on: ubuntu-latest
16+
permissions:
17+
contents: read
18+
packages: write
19+
# This is used to complete the identity challenge
20+
# with sigstore/fulcio when running outside of PRs.
21+
id-token: write
22+
23+
steps:
24+
- name: Checkout repository
25+
uses: actions/checkout@v4
26+
27+
- name: Set build variables
28+
id: build_vars
29+
run: |
30+
echo "IMAGE_NAME=${IMAGE_NAME,,}" >> $GITHUB_ENV
31+
32+
# Install the cosign tool except on PR
33+
# https://github.com/sigstore/cosign-installer
34+
- name: Install cosign
35+
if: github.event_name != 'pull_request'
36+
uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
37+
with:
38+
cosign-release: 'v2.2.4'
39+
40+
# Set up BuildKit Docker container builder to be able to build
41+
# multi-platform images and export cache
42+
# https://github.com/docker/setup-buildx-action
43+
- name: Set up Docker Buildx
44+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
45+
46+
# Login against a Docker registry except on PR
47+
# https://github.com/docker/login-action
48+
- name: Log into registry ${{ env.REGISTRY }}
49+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
50+
with:
51+
registry: ${{ env.REGISTRY }}
52+
username: ${{ github.actor }}
53+
password: ${{ secrets.GITHUB_TOKEN }}
54+
55+
# Extract metadata (tags, labels) for Docker
56+
# https://github.com/docker/metadata-action
57+
- name: Extract Docker metadata
58+
id: meta
59+
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
60+
with:
61+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
62+
63+
# Build and push Docker image with Buildx (don't push on PR)
64+
# https://github.com/docker/build-push-action
65+
- name: Build and push Docker image
66+
id: build-and-push
67+
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
68+
with:
69+
context: ./develop
70+
push: true
71+
tags: |
72+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
73+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }}
74+
labels: ${{ steps.meta.outputs.labels }}
75+
cache-from: type=gha
76+
cache-to: type=gha,mode=max
77+
78+
# Sign the resulting Docker image digest except on PRs.
79+
# This will only write to the public Rekor transparency log when the Docker
80+
# repository is public to avoid leaking data. If you would like to publish
81+
# transparency data even for private images, pass --force to cosign below.
82+
# https://github.com/sigstore/cosign
83+
- name: Sign the published Docker image
84+
env:
85+
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
86+
TAGS: ${{ steps.meta.outputs.tags }}
87+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
88+
# This step uses the identity token to provision an ephemeral certificate
89+
# against the sigstore community Fulcio instance.
90+
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
.idea/

‎README.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
framework3/runtime
2+
3+
Standard runtime for deploying new applications. Ships two containers:
4+
5+
* `develop` which is intended for local development, and includes debugging tools
6+
* `deploy` which is intended for all deployments (staging, UAT, production), designed to be lightweight

‎000-default.conf‎ renamed to ‎deploy/000-default.conf‎

File renamed without changes.

‎Dockerfile‎ renamed to ‎deploy/Dockerfile‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@ FROM php:8.3-apache
22

33
WORKDIR /var/www/html
44

5-
COPY ./security.conf /etc/apache2/conf-available/security.conf
6-
COPY ./php.ini /usr/local/etc/php/php.ini
7-
COPY ./000-default.conf /etc/apache2/sites-available/000-default.conf
8-
COPY ./supervisord.conf /etc/supervisor/supervisord.conf
5+
COPY security.conf /etc/apache2/conf-available/security.conf
6+
COPY php.ini /usr/local/etc/php/php.ini
7+
COPY 000-default.conf /etc/apache2/sites-available/000-default.conf
8+
COPY supervisord.conf /etc/supervisor/supervisord.conf
99
RUN a2enmod rewrite
1010

1111
# Create a non-root runtime user with group 33 (apache's www-data group)

‎php.ini‎ renamed to ‎deploy/php.ini‎

File renamed without changes.

‎security.conf‎ renamed to ‎deploy/security.conf‎

File renamed without changes.

0 commit comments

Comments
 (0)