Skip to content

build/bake: support reproducible timestamps with source-date-epoch #338

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
crazy-max wants to merge 1 commit into
base: main
Choose a base branch
from
Open

build/bake: support reproducible timestamps with source-date-epoch #338

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 30 additions & 0 deletions .github/workflows/.test-bake.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -750,3 +750,33 @@ jobs:
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
scope: 'dhi.io@pull'

bake-source-date-epoch:
strategy:
matrix:
epoch:
- '0'
- '1704067200'
- 'commit'
output:
- image
- local
uses: ./.github/workflows/bake.yml
permissions:
contents: read
id-token: write
with:
output: ${{ matrix.output }}
source-date-epoch: ${{ matrix.epoch }}
set-meta-labels: true
set-meta-annotations: true
meta-images: example/source-date-epoch
meta-labels: |
org.opencontainers.image.created=2000-01-01T00:00:00Z
meta-annotations: |
org.opencontainers.image.created=2000-01-01T00:00:00Z
context: test
target: source-date-epoch
set: |
*.args.SOURCE_DATE_EPOCH=1
*.args.EXPECTED_EPOCH=${{ matrix.epoch }}
29 changes: 29 additions & 0 deletions .github/workflows/.test-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -759,3 +759,32 @@ jobs:
username: ${{ vars.DOCKERHUB_OIDC_USERNAME }}
connection_id: ${{ vars.DOCKERHUB_OIDC_CONNECTIONID }}
scope: 'dhi.io@pull'

build-source-date-epoch:
strategy:
matrix:
epoch:
- '0'
- '1704067200'
- 'commit'
output:
- image
- local
uses: ./.github/workflows/build.yml
permissions:
contents: read
id-token: write
with:
output: ${{ matrix.output }}
source-date-epoch: ${{ matrix.epoch }}
set-meta-labels: true
set-meta-annotations: true
meta-images: example/source-date-epoch
meta-labels: |
org.opencontainers.image.created=2000-01-01T00:00:00Z
meta-annotations: |
org.opencontainers.image.created=2000-01-01T00:00:00Z
file: test/source-date-epoch.Dockerfile
build-args: |
SOURCE_DATE_EPOCH=1
EXPECTED_EPOCH=${{ matrix.epoch }}
43 changes: 38 additions & 5 deletions .github/workflows/bake.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,10 @@ on:
description: "Sign attestation manifest for image output or artifacts for local output, can be one of auto, true or false. The auto mode will enable signing if push is enabled for pushing the image or if artifact-upload is enabled for uploading the local build output as GitHub Artifact"
required: false
default: auto
source-date-epoch:
type: string
description: "Reproducible timestamp: commit or a non-negative Unix timestamp (empty disables)"
required: false
target:
type: string
description: "Bake target to build"
Expand Down Expand Up @@ -219,6 +223,8 @@ jobs:
include:
- name: ${{ inputs.job-name-prefix }}
outputs:
sourceDateEpoch: ${{ steps.set.outputs.sourceDateEpoch }}
sourceDateCreated: ${{ steps.set.outputs.sourceDateCreated }}
includes: ${{ steps.set.outputs.includes }}
metaImages: ${{ steps.set.outputs.metaImages }}
sign: ${{ steps.set.outputs.sign }}
Expand Down Expand Up @@ -330,6 +336,7 @@ jobs:
INPUT_SBOM: ${{ inputs.sbom }}
INPUT_SET: ${{ inputs.set }}
INPUT_SIGN: ${{ inputs.sign }}
INPUT_SOURCE-DATE-EPOCH: ${{ inputs.source-date-epoch }}
INPUT_TARGET: ${{ inputs.target }}
INPUT_VARS: ${{ inputs.vars }}
INPUT_GITHUB-TOKEN: ${{ secrets.github-token || github.token }}
Expand All @@ -341,6 +348,7 @@ jobs:
const { Build } = require('@docker/github-builder-runtime/lib/buildx/build');
const { GitHub } = require('@docker/github-builder-runtime/lib/github/github');
const { MetaImages } = require('@docker/github-builder-runtime/lib/github-builder/meta-images');
const { SourceDateEpoch } = require('@docker/github-builder-runtime/lib/github-builder/source-date-epoch');
const { RunnerMapping } = require('@docker/github-builder-runtime/lib/github-builder/runner-mapping');
const { BakeTargets } = require('@docker/github-builder-runtime/lib/github-builder/bake-targets');
const { BakeVars } = require('@docker/github-builder-runtime/lib/github-builder/bake-vars');
Expand All @@ -364,10 +372,17 @@ jobs:
const inpSbom = core.getBooleanInput('sbom');
const inpSet = Util.getInputList('set', {ignoreComma: true, quote: false});
const inpSign = core.getInput('sign');
const inpSourceDateEpoch = core.getInput('source-date-epoch');
const inpTarget = core.getInput('target');
const inpGitHubToken = core.getInput('github-token');
const inpProxyNetwork = core.getBooleanInput('buildkit-proxy-network');

if (inpSourceDateEpoch !== '') {
const {epoch, created} = await SourceDateEpoch.resolve(inpSourceDateEpoch, {token: inpGitHubToken});
core.setOutput('sourceDateEpoch', epoch);
core.setOutput('sourceDateCreated', created);
}

let runnerConfig;
try {
runnerConfig = RunnerMapping.parse(inpRunner);
Expand Down Expand Up @@ -595,8 +610,12 @@ jobs:
images: ${{ needs.prepare.outputs.metaImages }}
tags: ${{ inputs.meta-tags }}
flavor: ${{ inputs.meta-flavor }}
labels: ${{ inputs.meta-labels }}
annotations: ${{ inputs.meta-annotations }}
labels: |
${{ inputs.meta-labels }}
${{ needs.prepare.outputs.sourceDateCreated != '' && format('org.opencontainers.image.created={0}', needs.prepare.outputs.sourceDateCreated) || '' }}
annotations: |
${{ inputs.meta-annotations }}
${{ needs.prepare.outputs.sourceDateCreated != '' && format('org.opencontainers.image.created={0}', needs.prepare.outputs.sourceDateCreated) || '' }}
bake-target: ${{ inputs.meta-bake-target }}
-
name: Set up QEMU
Expand Down Expand Up @@ -822,6 +841,7 @@ jobs:
id: prepare
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
INPUT_SOURCE-DATE-EPOCH: ${{ needs.prepare.outputs.sourceDateEpoch }}
INPUT_PLATFORM: ${{ matrix.platform }}
INPUT_SBOM-IMAGE: ${{ env.SBOM_IMAGE }}
INPUT_LOCAL-EXPORT-DIR: ${{ env.LOCAL_EXPORT_DIR }}
Expand Down Expand Up @@ -856,6 +876,12 @@ jobs:
const { GitHub } = require('@docker/github-builder-runtime/lib/github/github');
const { Util } = require('@docker/github-builder-runtime/lib/util');

const inpSourceDateEpoch = core.getInput('source-date-epoch');
if (inpSourceDateEpoch !== '') {
core.exportVariable('SOURCE_DATE_EPOCH', inpSourceDateEpoch);
}
const rewriteTimestamp = inpSourceDateEpoch !== '' ? ',rewrite-timestamp=true' : '';

const inpPlatform = core.getInput('platform');
const platformPairSuffix = inpPlatform ? `-${inpPlatform.replace(/\//g, '-')}` : '';
core.setOutput('platform-pair-suffix', platformPairSuffix);
Expand Down Expand Up @@ -954,7 +980,7 @@ jobs:
core.setFailed('meta-images is required when output is image');
return;
}
outputOverride = `*.output=type=image,"name=${inpMetaImages.join(',')}",oci-artifact=true,push-by-digest=true,name-canonical=true,push=${inpPush}`;
outputOverride = `*.output=type=image,"name=${inpMetaImages.join(',')}",oci-artifact=true,push-by-digest=true,name-canonical=true,push=${inpPush}${rewriteTimestamp}`;
break;
case 'local':
outputOverride = `*.output=type=local,platform-split=true,dest=${inpLocalExportDir}`;
Expand All @@ -972,6 +998,9 @@ jobs:
return;
}
await core.group(`Set bake overrides`, async () => {
if (inpSourceDateEpoch !== '') {
bakeOverrides.push(`*.args.SOURCE_DATE_EPOCH=${inpSourceDateEpoch}`);
}
bakeOverrides.push(outputOverride);
bakeOverrides.push('*.tags=');
if (GitHub.context.payload.repository?.private ?? false) {
Expand Down Expand Up @@ -1254,8 +1283,12 @@ jobs:
images: ${{ needs.prepare.outputs.metaImages }}
tags: ${{ inputs.meta-tags }}
flavor: ${{ inputs.meta-flavor }}
labels: ${{ inputs.meta-labels }}
annotations: ${{ inputs.meta-annotations }}
labels: |
${{ inputs.meta-labels }}
${{ needs.prepare.outputs.sourceDateCreated != '' && format('org.opencontainers.image.created={0}', needs.prepare.outputs.sourceDateCreated) || '' }}
annotations: |
${{ inputs.meta-annotations }}
${{ needs.prepare.outputs.sourceDateCreated != '' && format('org.opencontainers.image.created={0}', needs.prepare.outputs.sourceDateCreated) || '' }}
bake-target: ${{ inputs.meta-bake-target }}
-
name: Configure AWS credentials
Expand Down
46 changes: 41 additions & 5 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,10 @@ on:
description: "Sign attestation manifest for image output or artifacts for local output, can be one of auto, true or false. The auto mode will enable signing if push is enabled for pushing the image or if artifact-upload is enabled for uploading the local build output as GitHub Artifact"
required: false
default: auto
source-date-epoch:
type: string
description: "Reproducible timestamp: commit or a non-negative Unix timestamp (empty disables)"
required: false
target:
type: string
description: "Sets the target stage to build"
Expand Down Expand Up @@ -230,6 +234,8 @@ jobs:
include:
- name: ${{ inputs.job-name-prefix }}
outputs:
sourceDateEpoch: ${{ steps.set.outputs.sourceDateEpoch }}
sourceDateCreated: ${{ steps.set.outputs.sourceDateCreated }}
includes: ${{ steps.set.outputs.includes }}
metaImages: ${{ steps.set.outputs.metaImages }}
sign: ${{ steps.set.outputs.sign }}
Expand Down Expand Up @@ -328,11 +334,14 @@ jobs:
INPUT_PUSH: ${{ inputs.push }}
INPUT_REGISTRY-LOGIN: ${{ inputs.registry-login }}
INPUT_SIGN: ${{ inputs.sign }}
INPUT_SOURCE-DATE-EPOCH: ${{ inputs.source-date-epoch }}
INPUT_GITHUB-TOKEN: ${{ secrets.github-token || github.token }}
INPUT_BUILDKIT-PROXY-NETWORK: ${{ inputs.buildkit-proxy-network }}
with:
script: |
const { GitHub } = require('@docker/github-builder-runtime/lib/github/github');
const { MetaImages } = require('@docker/github-builder-runtime/lib/github-builder/meta-images');
const { SourceDateEpoch } = require('@docker/github-builder-runtime/lib/github-builder/source-date-epoch');
const { RunnerMapping } = require('@docker/github-builder-runtime/lib/github-builder/runner-mapping');
const { Util } = require('@docker/github-builder-runtime/lib/util');

Expand All @@ -349,8 +358,16 @@ jobs:
const inpPush = core.getBooleanInput('push');
const inpRegistryLogin = core.getInput('registry-login');
const inpSign = core.getInput('sign');
const inpSourceDateEpoch = core.getInput('source-date-epoch');
const inpGitHubToken = core.getInput('github-token');
const inpProxyNetwork = core.getBooleanInput('buildkit-proxy-network');

if (inpSourceDateEpoch !== '') {
const {epoch, created} = await SourceDateEpoch.resolve(inpSourceDateEpoch, {token: inpGitHubToken});
core.setOutput('sourceDateEpoch', epoch);
core.setOutput('sourceDateCreated', created);
}

let runnerConfig;
try {
runnerConfig = RunnerMapping.parse(inpRunner);
Expand Down Expand Up @@ -526,8 +543,12 @@ jobs:
images: ${{ needs.prepare.outputs.metaImages }}
tags: ${{ inputs.meta-tags }}
flavor: ${{ inputs.meta-flavor }}
labels: ${{ inputs.meta-labels }}
annotations: ${{ inputs.meta-annotations }}
labels: |
${{ inputs.meta-labels }}
${{ needs.prepare.outputs.sourceDateCreated != '' && format('org.opencontainers.image.created={0}', needs.prepare.outputs.sourceDateCreated) || '' }}
annotations: |
${{ inputs.meta-annotations }}
${{ needs.prepare.outputs.sourceDateCreated != '' && format('org.opencontainers.image.created={0}', needs.prepare.outputs.sourceDateCreated) || '' }}
-
name: Set up QEMU
uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
Expand Down Expand Up @@ -752,6 +773,7 @@ jobs:
id: prepare
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
env:
INPUT_SOURCE-DATE-EPOCH: ${{ needs.prepare.outputs.sourceDateEpoch }}
INPUT_PLATFORM: ${{ matrix.platform }}
INPUT_SBOM-IMAGE: ${{ env.SBOM_IMAGE }}
INPUT_LOCAL-EXPORT-DIR: ${{ env.LOCAL_EXPORT_DIR }}
Expand Down Expand Up @@ -784,6 +806,12 @@ jobs:
const { GitHub } = require('@docker/github-builder-runtime/lib/github/github');
const { Util } = require('@docker/github-builder-runtime/lib/util');

const inpSourceDateEpoch = core.getInput('source-date-epoch');
if (inpSourceDateEpoch !== '') {
core.exportVariable('SOURCE_DATE_EPOCH', inpSourceDateEpoch);
}
const rewriteTimestamp = inpSourceDateEpoch !== '' ? ',rewrite-timestamp=true' : '';

const inpPlatform = core.getInput('platform');
const platformPairSuffix = inpPlatform ? `-${inpPlatform.replace(/\//g, '-')}` : '';
core.setOutput('platform-pair-suffix', platformPairSuffix);
Expand Down Expand Up @@ -831,7 +859,7 @@ jobs:
core.setFailed('meta-images is required when output is image');
return;
}
core.setOutput('output', `type=image,"name=${inpMetaImages.join(',')}",oci-artifact=true,push-by-digest=true,name-canonical=true,push=${inpPush}`);
core.setOutput('output', `type=image,"name=${inpMetaImages.join(',')}",oci-artifact=true,push-by-digest=true,name-canonical=true,push=${inpPush}${rewriteTimestamp}`);
break;
case 'local':
core.setOutput('output', `type=local,platform-split=true,dest=${inpLocalExportDir}`);
Expand Down Expand Up @@ -877,6 +905,10 @@ jobs:
labels.push(...inpMetaLabels);
}
core.setOutput('labels', labels.join('\n'));

if (inpSourceDateEpoch !== '') {
buildArgs += `\nSOURCE_DATE_EPOCH=${inpSourceDateEpoch}`;
}
core.setOutput('build-args', buildArgs);

let buildSecrets;
Expand Down Expand Up @@ -1151,8 +1183,12 @@ jobs:
images: ${{ needs.prepare.outputs.metaImages }}
tags: ${{ inputs.meta-tags }}
flavor: ${{ inputs.meta-flavor }}
labels: ${{ inputs.meta-labels }}
annotations: ${{ inputs.meta-annotations }}
labels: |
${{ inputs.meta-labels }}
${{ needs.prepare.outputs.sourceDateCreated != '' && format('org.opencontainers.image.created={0}', needs.prepare.outputs.sourceDateCreated) || '' }}
annotations: |
${{ inputs.meta-annotations }}
${{ needs.prepare.outputs.sourceDateCreated != '' && format('org.opencontainers.image.created={0}', needs.prepare.outputs.sourceDateCreated) || '' }}
-
name: Configure AWS credentials
if: ${{ inputs.push && inputs.output == 'image' && needs.registry-identities.outputs.aws-ecr-enabled == 'true' }}
Expand Down
Loading
Loading