diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml index 9e376c0..042ced9 100644 --- a/.github/workflows/build-image.yml +++ b/.github/workflows/build-image.yml @@ -31,9 +31,9 @@ jobs: include: # platform_id: For GH actions output discriminator. - platform_id: linux-amd64 - runner: ubuntu-24.04 + runner: custom-ubuntu-24.04-x86_64 - platform_id: linux-arm64 - runner: ubuntu-24.04-arm + runner: custom-ubuntu-24.04-aarch64 permissions: contents: read @@ -41,7 +41,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: # Reproduce the exact commit hash value fetch-depth: 0 @@ -55,12 +55,10 @@ jobs: - name: Setup Docker buildx id: setup-buildx - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 with: - # nightly: @see https://github.com/moby/buildkit/commit/fe65d5ff62506d0bccdcc4641fad1920903fcf55 - # > remotecache: fix inline cache used with multiple exporters driver-opts: >- - image=docker.io/moby/buildkit:v0.25.1@sha256:79cc6476ab1a3371c9afd8b44e7c55610057c43e18d9b39b68e2b0c2475cc1b6 + image=docker.io/moby/buildkit:v0.26.3@sha256:5601811fde88bb9e8a577bfe804af82bccb712e1cd07ff94663bded5e628cf75 buildkitd-flags: >- --oci-worker-snapshotter=stargz @@ -73,7 +71,7 @@ jobs: - name: Docker meta id: docker-meta - uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0 + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0 with: annotations: | org.opencontainers.image.created={{commit_date 'YYYY-MM-DDTHH:mm:ss.SSS[Z]'}} @@ -177,6 +175,7 @@ jobs: packages: write id-token: write attestations: write + artifact-metadata: write steps: - name: Retrieve build outputs @@ -189,7 +188,7 @@ jobs: - name: Setup Docker buildx id: setup-buildx - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Login to Container Registry uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 @@ -200,7 +199,7 @@ jobs: - name: Docker meta id: docker-meta - uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0 + uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0 with: images: | ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} @@ -231,7 +230,7 @@ jobs: echo "digest=$digest" >> "$GITHUB_OUTPUT" - name: Create attestation - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0 + uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8 # v3.1.0 with: subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} subject-digest: ${{ steps.create-manifest.outputs.digest }} diff --git a/.github/workflows/repo-snapshot.yml b/.github/workflows/repo-snapshot.yml index 399eba4..556dd6e 100644 --- a/.github/workflows/repo-snapshot.yml +++ b/.github/workflows/repo-snapshot.yml @@ -18,22 +18,22 @@ jobs: outputs: digest: ${{ steps.build.outputs.digest }} tag: ${{ steps.tag.outputs.tag }} - runs-on: ubuntu-24.04 + runs-on: custom-ubuntu-24.04-x86_64 permissions: contents: read packages: write steps: - name: Checkout - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: fetch-depth: 0 - name: Set up QEMU - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 + uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Login to Container Registry uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 diff --git a/image/repo-snapshot/Dockerfile b/image/repo-snapshot/Dockerfile index 2f75868..60f4e1b 100644 --- a/image/repo-snapshot/Dockerfile +++ b/image/repo-snapshot/Dockerfile @@ -1,7 +1,7 @@ -# syntax=docker/dockerfile:1.19.0@sha256:b6afd42430b15f2d2a4c5a02b919e98a525b785b1aaff16747d2f623364e39b6 +# syntax=docker/dockerfile:1.20.0@sha256:26147acbda4f14c5add9946e2fd2ed543fc402884fd75146bd342a7f6271dc1d # Syntax: https://github.com/moby/buildkit/blob/v0.25/frontend/dockerfile/docs/reference.md -FROM docker.io/almalinux/10-toolbox:10.0-20250909@sha256:7008515eb22deb3ab06a6f7cefb9e6d561da65a12825364188511ea5a99c03e1 AS downloader +FROM docker.io/almalinux/10-toolbox:10.1-20251124@sha256:5c733ba41634d8b760a437d43fb92d202ea33821d832b91656ad16e59ee30dc5 AS downloader ARG TARGETARCH ARG TARGETVARIANT diff --git a/image/stage0/Dockerfile b/image/stage0/Dockerfile index 115d980..e3eb30e 100644 --- a/image/stage0/Dockerfile +++ b/image/stage0/Dockerfile @@ -1,14 +1,12 @@ -# syntax=docker/dockerfile:1.19.0@sha256:b6afd42430b15f2d2a4c5a02b919e98a525b785b1aaff16747d2f623364e39b6 +# syntax=docker/dockerfile:1.20.0@sha256:26147acbda4f14c5add9946e2fd2ed543fc402884fd75146bd342a7f6271dc1d # Syntax: https://github.com/moby/buildkit/blob/v0.25/frontend/dockerfile/docs/reference.md # https://raw.githubusercontent.com/AlmaLinux/container-images/9ec2d07542f07e6781d6f388e66f1e3f2aac889e/Containerfiles/10/Containerfile.toolbox -FROM docker.io/almalinux/10-toolbox:10.0-20250909@sha256:7008515eb22deb3ab06a6f7cefb9e6d561da65a12825364188511ea5a99c03e1 AS base +FROM docker.io/almalinux/10-toolbox:10.1-20251124@sha256:5c733ba41634d8b760a437d43fb92d202ea33821d832b91656ad16e59ee30dc5 AS s0 ENV LANG=C LC_CTYPE=C.UTF-8 LC_COLLATE=C ENV SYSTEMD_OFFLINE=1 -FROM docker.io/almalinux/10-toolbox:10.0-20250909@sha256:7008515eb22deb3ab06a6f7cefb9e6d561da65a12825364188511ea5a99c03e1 AS s0 - RUN --mount=from=container-script,target=/tmp/container-script,readonly \ --mount=type=tmpfs,target=/tmp --mount=type=tmpfs,target=/run \ --mount=type=tmpfs,target=/var/log \ diff --git a/image/stage1/Dockerfile b/image/stage1/Dockerfile index 1e16d6d..4555f69 100644 --- a/image/stage1/Dockerfile +++ b/image/stage1/Dockerfile @@ -1,4 +1,4 @@ -# syntax=docker/dockerfile:1.19.0@sha256:b6afd42430b15f2d2a4c5a02b919e98a525b785b1aaff16747d2f623364e39b6 +# syntax=docker/dockerfile:1.20.0@sha256:26147acbda4f14c5add9946e2fd2ed543fc402884fd75146bd342a7f6271dc1d FROM stage0 AS root diff --git a/image/stage2/Dockerfile b/image/stage2/Dockerfile index d0b9073..c1cd831 100644 --- a/image/stage2/Dockerfile +++ b/image/stage2/Dockerfile @@ -1,4 +1,4 @@ -# syntax=docker/dockerfile:1.19.0@sha256:b6afd42430b15f2d2a4c5a02b919e98a525b785b1aaff16747d2f623364e39b6 +# syntax=docker/dockerfile:1.20.0@sha256:26147acbda4f14c5add9946e2fd2ed543fc402884fd75146bd342a7f6271dc1d FROM stage1 AS root diff --git a/image/stage3/Dockerfile b/image/stage3/Dockerfile index 4d1eb33..a3b5c58 100644 --- a/image/stage3/Dockerfile +++ b/image/stage3/Dockerfile @@ -1,6 +1,6 @@ -# syntax=docker/dockerfile:1.19.0@sha256:b6afd42430b15f2d2a4c5a02b919e98a525b785b1aaff16747d2f623364e39b6 +# syntax=docker/dockerfile:1.20.0@sha256:26147acbda4f14c5add9946e2fd2ed543fc402884fd75146bd342a7f6271dc1d -FROM docker.io/almalinux/10-toolbox:10.0-20250909@sha256:7008515eb22deb3ab06a6f7cefb9e6d561da65a12825364188511ea5a99c03e1 AS toolbox +FROM docker.io/almalinux/10-toolbox:10.1-20251124@sha256:5c733ba41634d8b760a437d43fb92d202ea33821d832b91656ad16e59ee30dc5 AS toolbox FROM toolbox AS download-bazelisk RUN --mount=type=cache,id=download-bazelisk,target=/var/cache/download <&2 ; exit 1 ;; esac diff --git a/image/test-build-local.sh b/image/test-build-local.sh index 85b315f..31ddf72 100755 --- a/image/test-build-local.sh +++ b/image/test-build-local.sh @@ -3,7 +3,7 @@ readonly SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) readonly BUILD_DIR=$(realpath "$SCRIPT_DIR"/../build) -readonly buildkit_image='docker.io/moby/buildkit:v0.25.1@sha256:79cc6476ab1a3371c9afd8b44e7c55610057c43e18d9b39b68e2b0c2475cc1b6' +readonly buildkit_image='docker.io/moby/buildkit:v0.26.3@sha256:5601811fde88bb9e8a577bfe804af82bccb712e1cd07ff94663bded5e628cf75' readonly REGISTRY_PORT=51350 readonly REGISTRY_HOST="localhost:${REGISTRY_PORT}"