build stuff

rancher · Jan 30, 2025 · 0a2e8f1 · 0a2e8f1
1 parent c1d66fe
commit 0a2e8f1
Show file tree

Hide file tree

Showing 2 changed files with 41 additions and 2 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -8,6 +8,7 @@ on:
 permissions:
   contents: read
   security-events: write # upload Sarif results
+  id-token: write
 
 name: Build
 jobs:
@@ -21,6 +22,22 @@ jobs:
       id: get-TAG
       run: |
         echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV"
+
+    - name: "Read secrets"
+      id: read-secrets
+      uses: rancher-eio/read-vault-secrets@main
+      with:
+        secrets: |
+          secret/data/github/repo/${{ github.repository }}/github/release-app-credentials appId | APP_ID ;
+          secret/data/github/repo/${{ github.repository }}/github/release-app-credentials privateKey | PRIVATE_KEY
+
+    - name: "Generate GH App Token"
+      id: app-token
+      uses: actions/create-github-app-token@v1
+      with:
+        app-id: ${{ env.APP_ID }}
+        private-key: ${{ env.PRIVATE_KEY }}
+
     - name: Build container image
       uses: docker/build-push-action@v6
       with:
@@ -30,6 +47,8 @@ jobs:
         file: Dockerfile
         build-args: |
           TAG=${{ env.TAG }}
+          CNI_SRC=x-access-token:${{ steps.app-token.outputs.token }}@github.com/rancher/release-cni-plugin
+          CNP_SRC=x-access-token:${{ steps.app-token.outputs.token }}@github.com/rancher/release-container-networking-plugins
 
     - name: Run Trivy vulnerability scanner
       uses: aquasecurity/trivy-action@0.29.0
@@ -62,6 +81,22 @@ jobs:
       id: get-TAG
       run: |
         echo "$(make -s log | grep TAG)" >> "$GITHUB_ENV"
+
+    - name: "Read secrets"
+      id: read-secrets
+      uses: rancher-eio/read-vault-secrets@main
+      with:
+        secrets: |
+          secret/data/github/repo/${{ github.repository }}/github/release-app-credentials appId | APP_ID ;
+          secret/data/github/repo/${{ github.repository }}/github/release-app-credentials privateKey | PRIVATE_KEY
+
+    - name: "Generate GH App Token"
+      id: app-token
+      uses: actions/create-github-app-token@v1
+      with:
+        app-id: ${{ env.APP_ID }}
+        private-key: ${{ env.PRIVATE_KEY }}
+
     - name: Build container image
       uses: docker/build-push-action@v6
       with:
@@ -73,3 +108,5 @@ jobs:
         platforms: linux/arm64
         build-args: |
           TAG=${{ env.TAG }}
+          CNI_SRC=x-access-token:${{ steps.app-token.outputs.token }}@github.com/rancher/release-cni-plugin
+          CNP_SRC=x-access-token:${{ steps.app-token.outputs.token }}@github.com/rancher/release-container-networking-plugins
diff --git a/Dockerfile b/Dockerfile
@@ -16,17 +16,19 @@ RUN set -x && \
     xx-apk --no-cache add musl-dev gcc 
 
 FROM base_builder AS cni_plugins_builder
+ARG CNI_SRC=github.com/rancher/release-cni-plugin
+ARG CNP_SRC=github.com/rancher/release-container-networking-plugins
 ARG TAG=v1.6.2
 ARG FLANNEL_TAG=v1.6.0-flannel1
 ARG GOEXPERIMENT
 #clone and get dependencies
-RUN git clone --depth=1 https://github.com/rancher/release-container-networking-plugins.git $GOPATH/src/github.com/containernetworking/plugins && \
+RUN git clone --depth=1 https://${CNP_SRC}.git $GOPATH/src/github.com/containernetworking/plugins && \
     cd $GOPATH/src/github.com/containernetworking/plugins && \
     git fetch --all --tags --prune && \
     git checkout tags/${TAG} -b ${TAG} &&\
     go mod download
 
-RUN git clone --depth=1 https://github.com/rancher/release-cni-plugin $GOPATH/src/github.com/flannel-io/cni-plugin && \
+RUN git clone --depth=1 https://${CNI_SRC} $GOPATH/src/github.com/flannel-io/cni-plugin && \
     cd $GOPATH/src/github.com/flannel-io/cni-plugin && \
     git fetch --all --tags --prune && \
     git checkout tags/${FLANNEL_TAG} -b ${FLANNEL_TAG} && \