Skip to content

chore(actions): harden workflows + migrate to chainguard #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sebastiandero merged 2 commits into from
May 26, 2026
Merged

chore(actions): harden workflows + migrate to chainguard #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bf7ac12
chore(actions): harden workflows + migrate to chainguard
sebastiandero May 25, 2026
6542cab
chore(actions): add concurrency + job names + template-injection fixes
sebastiandero May 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
122 changes: 79 additions & 43 deletions .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,41 +6,52 @@ on:
tags: [ "v*" ]
pull_request:
branches: [ main ]

permissions:
contents: read

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

jobs:
tests:
name: Tests
runs-on: ubuntu-latest

steps:
- name: Checkout
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
uses: chainguard-actions/actions-checkout@d1f1061cdaee56aa3a3bc3deb86b67b1db772dd6 # v6.0.2
with:
# fetching all tags is required for the Makefile to compute the right version
fetch-depth: 0
persist-credentials: false

- name: Set up Go
uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492
uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2.2.0
with:
go-version: "1.20"
cache: false

- name: Set up QEMU dependency
uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480
uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # v1.2.0

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9
uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1.7.0

- name: Setup dependencies
run: sudo apt update && sudo apt install -y util-linux udev parted e2fsprogs mount tar extlinux qemu-utils qemu-system

- name: Share cache with other actions
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
with:
path: |
~/go/pkg/mod
/tmp/.buildx-cache
key: ${{ runner.os }}-tests-${{ github.sha }}
restore-keys: |
${{ runner.os }}-tests-
lookup-only: true

- name: Run linter
run: make vet
Expand All @@ -63,37 +74,42 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
uses: chainguard-actions/actions-checkout@d1f1061cdaee56aa3a3bc3deb86b67b1db772dd6 # v6.0.2
with:
# fetching all tags is required for the Makefile to compute the right version
fetch-depth: 0
persist-credentials: false

- name: Set up Go
uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492
uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2.2.0
with:
go-version: "1.20"
cache: false

- name: Set up QEMU dependency
uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480
uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # v1.2.0

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9
uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1.7.0

- name: Setup dependencies
run: sudo apt update && sudo apt install -y util-linux udev parted e2fsprogs mount tar extlinux qemu-utils qemu-system

- name: Share cache with other actions
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
with:
path: |
~/go/pkg/mod
/tmp/.buildx-cache
key: ${{ runner.os }}-tests-${{ github.sha }}
restore-keys: |
${{ runner.os }}-tests-
lookup-only: true

- name: Run tests
run: git --no-pager diff --exit-code HEAD~1 HEAD **/**.go templates/ || IMAGE=${{ matrix.image }} make test-templates
env:
MATRIX_IMAGE: ${{ matrix.image }}
run: git --no-pager diff --exit-code HEAD~1 HEAD **/**.go templates/ || IMAGE="${MATRIX_IMAGE}" make test-templates


e2e-tests:
Expand All @@ -107,63 +123,71 @@ jobs:
- debian:11
steps:
- name: Checkout
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
uses: chainguard-actions/actions-checkout@d1f1061cdaee56aa3a3bc3deb86b67b1db772dd6 # v6.0.2
with:
# fetching all tags is required for the Makefile to compute the right version
fetch-depth: 0
persist-credentials: false

- name: Set up Go
uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492
uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2.2.0
with:
go-version: "1.20"
cache: false

- name: Set up QEMU dependency
uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480
uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # v1.2.0

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9
uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1.7.0

- name: Setup dependencies
run: sudo apt update && sudo apt install -y util-linux udev parted e2fsprogs mount tar extlinux qemu-utils qemu-system ovmf

- name: Share cache with other actions
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
with:
path: |
~/go/pkg/mod
/tmp/.buildx-cache
key: ${{ runner.os }}-e2e-tests-${{ github.sha }}
restore-keys: |
${{ runner.os }}-tests-
lookup-only: true

- name: Run end-to-end tests
run: E2E_IMAGES=${{ matrix.image }} make e2e
env:
MATRIX_IMAGE: ${{ matrix.image }}
run: E2E_IMAGES="${MATRIX_IMAGE}" make e2e

docs-up-to-date:
name: Docs up to date
runs-on: ubuntu-latest

steps:
- name: Checkout
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
uses: chainguard-actions/actions-checkout@d1f1061cdaee56aa3a3bc3deb86b67b1db772dd6 # v6.0.2
with:
# fetching all tags is required for the Makefile to compute the right version
fetch-depth: 0
persist-credentials: false

- name: Set up Go
uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492
uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2.2.0
with:
go-version: "1.20"
cache: false

- name: Share cache with other actions
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
with:
path: |
~/go/pkg/mod
/tmp/.buildx-cache
key: ${{ runner.os }}-tests-${{ github.sha }}
restore-keys: |
${{ runner.os }}-tests-
lookup-only: true

- name: Check if docs are up to date
run: make docs-up-to-date
Expand All @@ -174,45 +198,48 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
uses: chainguard-actions/actions-checkout@d1f1061cdaee56aa3a3bc3deb86b67b1db772dd6 # v6.0.2
with:
# fetching all tags is required for the Makefile to compute the right version
fetch-depth: 0
persist-credentials: false

- name: Set up Go
uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492
uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2.2.0
with:
go-version: "1.20"
cache: false

- name: Set up QEMU dependency
uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480
uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # v1.2.0

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9
uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1.7.0

- name: Login to Docker Hub
uses: docker/login-action@dd4fa0671be5250ee6f50aedf4cb05514abda2c7
uses: docker/login-action@dd4fa0671be5250ee6f50aedf4cb05514abda2c7 # v1.14.1
if: startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main'
with:
username: ${{ secrets.DOCKER_HUB_USERNAME }}
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}

- name: Share cache with other actions
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
with:
path: |
~/go/pkg/mod
/tmp/.buildx-cache
key: ${{ runner.os }}-build-${{ github.sha }}
restore-keys: |
${{ runner.os }}-build-
lookup-only: true

- name: Ensure all files were well formatted
run: make check-fmt

- name: Import GPG key
id: import_gpg
uses: crazy-max/ghaction-import-gpg@e00cb83a68c1158b29afc5217dd0582cada6d172
uses: crazy-max/ghaction-import-gpg@e00cb83a68c1158b29afc5217dd0582cada6d172 # v4.4.0
if: startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main'
with:
gpg_private_key: ${{ secrets.GPG_KEY }}
Expand All @@ -234,38 +261,41 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
uses: chainguard-actions/actions-checkout@d1f1061cdaee56aa3a3bc3deb86b67b1db772dd6 # v6.0.2
with:
# fetching all tags is required for the Makefile to compute the right version
fetch-depth: 0
persist-credentials: false

- name: Set up Go
uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492
uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2.2.0
with:
go-version: "1.20"
cache: false

- name: Set up QEMU dependency
uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480
uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # v1.2.0

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9
uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1.7.0

- name: Login to Docker Hub
uses: docker/login-action@dd4fa0671be5250ee6f50aedf4cb05514abda2c7
uses: docker/login-action@dd4fa0671be5250ee6f50aedf4cb05514abda2c7 # v1.14.1
if: startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main'
with:
username: ${{ secrets.DOCKER_HUB_USERNAME }}
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}

- name: Share cache with other actions
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
with:
path: |
~/go/pkg/mod
/tmp/.buildx-cache
key: ${{ runner.os }}-build-image-${{ github.sha }}
restore-keys: |
${{ runner.os }}-build-image-
lookup-only: true

- name: Build Docker images
run: make docker-build
Expand All @@ -287,29 +317,32 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
uses: chainguard-actions/actions-checkout@d1f1061cdaee56aa3a3bc3deb86b67b1db772dd6 # v6.0.2
with:
# fetching all tags is required for the Makefile to compute the right version
fetch-depth: 0
persist-credentials: false

- name: Set up Go
uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492
uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2.2.0
with:
go-version: "1.20"
cache: false

- name: Share cache with other actions
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
with:
path: |
~/go/pkg/mod
/tmp/.buildx-cache
key: ${{ runner.os }}-build-${{ github.sha }}
restore-keys: |
${{ runner.os }}-build-
lookup-only: true

- name: Import GPG key
id: import_gpg
uses: crazy-max/ghaction-import-gpg@e00cb83a68c1158b29afc5217dd0582cada6d172
uses: crazy-max/ghaction-import-gpg@e00cb83a68c1158b29afc5217dd0582cada6d172 # v4.4.0
with:
gpg_private_key: ${{ secrets.GPG_KEY }}
passphrase: ${{ secrets.GPG_PASSWORD }}
Expand All @@ -336,37 +369,40 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
uses: chainguard-actions/actions-checkout@d1f1061cdaee56aa3a3bc3deb86b67b1db772dd6 # v6.0.2
with:
# fetching all tags is required for the Makefile to compute the right version
fetch-depth: 0
persist-credentials: false

- name: Set up Go
uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492
uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492 # v2.2.0
with:
go-version: "1.20"
cache: false

- name: Set up QEMU dependency
uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480
uses: docker/setup-qemu-action@27d0a4f181a40b142cce983c5393082c365d1480 # v1.2.0

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9
uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1.7.0

- name: Login to Docker Hub
uses: docker/login-action@dd4fa0671be5250ee6f50aedf4cb05514abda2c7
uses: docker/login-action@dd4fa0671be5250ee6f50aedf4cb05514abda2c7 # v1.14.1
with:
username: ${{ secrets.DOCKER_HUB_USERNAME }}
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}

- name: Share cache with other actions
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c
uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
with:
path: |
~/go/pkg/mod
/tmp/.buildx-cache
key: ${{ runner.os }}-build-image-${{ github.sha }}
restore-keys: |
${{ runner.os }}-build-image-
lookup-only: true

- name: Build Docker images
run: make docker-build
Expand Down
Loading
Loading